From de21c7a5440c01b5c9782d6e19b58d535a122117 Mon Sep 17 00:00:00 2001 From: MechaCat02 Date: Sat, 13 Jun 2026 10:38:17 +0200 Subject: [PATCH] [iterate-2G] db16cyc spin-hint cooperative yield: unblock title-screen 0x10a0 gate MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The silph title state machine (tid13) blocked on event 0x10a0, never signaled. Root: the event's producer chain runs on the silph worker (entry 0x821C4AD0, our tid14), which was starved. tid14 shares a HW slot with a guest spinlock/ barrier participant (sub_824D1328, entry 0x824D2940) that busy-spins on the db16cyc hint `or r31,r31,r31` (encoding 0x7FFFFB78) at 0x824D140C. Under our round-robin lockstep the spinner consumed its whole block every round and starved the co-located tid14 (only 9 progress hits over 200M instr) — so the producer never reached the event-create/duplicate/signal dance the canary oracle performs (handle F80000E8 set by the submitter F8000044 via a duplicated handle). Fix (canary-faithful): recognize the db16cyc spin hint exactly as canary's InstrEmit_orx does (code 0x7FFFFB78 -> DelayExecution) and surface it as a new StepResult::Yield. The scheduler's yield_current() promotes every Ready peer on the slot past STARVE_LIMIT so begin_slot_visit picks one next round, then they reset and the spinner reclaims the slot — fair alternation, no priority inversion, pure function of slot state (deterministic). Result (lockstep, cache-persist, -n 200M): tid14 progresses past its old stall into a real wait; tid13 advances off 0x10a0 to a new event; hub/submitter re-enter their wait loops. imports 280k->592k, packets 124M->164M, swaps 1->2. draws still 0 (the splash's first draw is a further-upstream gate). Determinism preserved (two cold n50m runs byte-identical). n50m golden re-baselined (imports 90296->339766, swaps 1->2; draws unchanged 0). n2m golden unchanged (db16cyc not reached in first 2M). Tests 670/670. Co-Authored-By: Claude Opus 4.8 (1M context) --- audit-runs/audit-009/branch-probe.trace | 0 .../FINDINGS.md | 131 + .../ROUND_34_PLAN.md | 116 + .../disasm-sub82450B60.txt | 200 + .../disasm-sub82451238.txt | 80 + .../round35-lockstep-inflate/diff.out | 52 + .../round35-lockstep-inflate/diff.py | 175 + .../round36-dispatcher-ctx/first-fire.txt | 17 + .../round9-sub821B6DF4-caller/canary.log.run1 | 33989 ++++++++++++++ .../round9-sub821B6DF4-caller/canary.log.run2 | 36380 +++++++++++++++ .../round9-sub821B6DF4-caller/canary.log.run3 | 36355 +++++++++++++++ .../canary.log.run4_toml | 36329 +++++++++++++++ .../canary.log.sub821B55D8 | 36551 ++++++++++++++++ .../canary.log.sub821B6DF4_zero | 36427 +++++++++++++++ .../canary.stderr.run1 | 89 + .../canary.stderr.run2 | 89 + .../canary.stderr.run3 | 89 + .../canary.stderr.run4_toml | 89 + .../canary.stderr.sub821B55D8 | 89 + .../canary.stderr.sub821B6DF4_zero | 89 + .../canary.stdout.run1 | 33989 ++++++++++++++ .../canary.stdout.run2 | 36380 +++++++++++++++ .../canary.stdout.run3 | 36355 +++++++++++++++ .../canary.stdout.run4_toml | 36329 +++++++++++++++ .../canary.stdout.sub821B55D8 | 36551 ++++++++++++++++ .../canary.stdout.sub821B6DF4_zero | 36427 +++++++++++++++ .../DEFERRED_FIXES.md | 47 + crates/xenia-app/src/main.rs | 12 + .../xenia-app/tests/golden/sylpheed_n50m.json | 6 +- crates/xenia-cpu/src/interpreter.rs | 58 + crates/xenia-cpu/src/scheduler.rs | 100 + 31 files changed, 433587 insertions(+), 3 deletions(-) create mode 100644 audit-runs/audit-009/branch-probe.trace create mode 100644 audit-runs/audit-059-handle-disambiguation/FINDINGS.md create mode 100644 audit-runs/audit-059-handle-disambiguation/ROUND_34_PLAN.md create mode 100644 audit-runs/audit-059-handle-disambiguation/round27-state-advance/disasm-sub82450B60.txt create mode 100644 audit-runs/audit-059-handle-disambiguation/round27-state-advance/disasm-sub82451238.txt create mode 100644 audit-runs/audit-059-handle-disambiguation/round35-lockstep-inflate/diff.out create mode 100644 audit-runs/audit-059-handle-disambiguation/round35-lockstep-inflate/diff.py create mode 100644 audit-runs/audit-059-handle-disambiguation/round36-dispatcher-ctx/first-fire.txt create mode 100644 audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.log.run1 create mode 100644 audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.log.run2 create mode 100644 audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.log.run3 create mode 100644 audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.log.run4_toml create mode 100644 audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.log.sub821B55D8 create mode 100644 audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.log.sub821B6DF4_zero create mode 100644 audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.stderr.run1 create mode 100644 audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.stderr.run2 create mode 100644 audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.stderr.run3 create mode 100644 audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.stderr.run4_toml create mode 100644 audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.stderr.sub821B55D8 create mode 100644 audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.stderr.sub821B6DF4_zero create mode 100644 audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.stdout.run1 create mode 100644 audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.stdout.run2 create mode 100644 audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.stdout.run3 create mode 100644 audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.stdout.run4_toml create mode 100644 audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.stdout.sub821B55D8 create mode 100644 audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.stdout.sub821B6DF4_zero create mode 100644 audit-runs/iterate-2D-deferred-fixes/DEFERRED_FIXES.md diff --git a/audit-runs/audit-009/branch-probe.trace b/audit-runs/audit-009/branch-probe.trace new file mode 100644 index 0000000..e69de29 diff --git a/audit-runs/audit-059-handle-disambiguation/FINDINGS.md b/audit-runs/audit-059-handle-disambiguation/FINDINGS.md new file mode 100644 index 0000000..7eb8c70 --- /dev/null +++ b/audit-runs/audit-059-handle-disambiguation/FINDINGS.md @@ -0,0 +1,131 @@ +# AUDIT-059 — handle disambiguation (iterate 2.BD) + +**Date:** 2026-06-06. **Engines:** ours `target/release/xenia-rs -n 50M` (3.9 s wall, 50M instr, 40k import calls), canary Wine `xenia_canary.exe --mute=true --audit_handle_lifecycle=true` (~35 s wall, 34k log lines, 0 fatals). + +## Verdict — HANDOFF's wedge handles are stale + +HANDOFF said: *"opt_callback signals 0x108c, tid=1 wedges on 0x10e8."* Both IDs are now `` in ours, along with `0x1090 / 0x10dc / 0x10fc / 0x1104` (also in HANDOFF's adjacent list). The allocation order shifted since that snapshot. + +## Real wedges, current code state + +| Handle | Kind | Engine state | Waiter | Notes | +|---|---|---|---|---| +| **0x12a4** | `` | ``, waiters=1 | **tid=1 main**, pc=0x824ac578 | Wait went via `do_wait_single` but creation never hit `NtCreateEvent` — `KeInitializeEvent` path. **This is the iterate-2.BC wedge** (recorded as "0x10e8" in HANDOFF — same site, different ID). | +| **0x12ac** | Event/Auto | ``, waiters=1 | **tid=13** silph UI cluster, pc=0x824ac578 lr=0x821cb1e0 | Frame trail: `0x821cb1e0 → 0x821cbae0 → 0x821cc454 → 0x821c4f18 → 0x82174a80`. Frames 3-5 carry `silph::UImpl@GamePart_Title` / `silph::VGamePart_Title` vtables — **audit-049's cluster, unchanged**. | +| 0x12b8 | Event/Auto | NO_SIGNALS, waiters=1 | (tid TBD) | Sibling, 0xC bytes from 0x12ac. | +| 0x1020 | Event/Manual | NO_SIGNALS, waiters=1 | — | γ-class. | +| 0x1040 | Event/Auto | NO_SIGNALS, waits=32 (hot poll) | — | Heavy wait, no signal. | +| 0x10a8 | Event/Auto | NO_SIGNALS, waits=7 | — | γ-class. | +| 0x10e4 | Event/Manual | NO_SIGNALS, waiters=1, waits=2 | — | γ-class. | + +**Working handles** (sanity baseline): 0x1028 (Sema, 8 waits / 7 signals / 7 wakes), 0x10d0 (Sema, 2 waits / 1 signal / 1 wake), 0x10f0 (Event/Auto, 1/1/1 ✓ marked `` but actually fine), 0x10e0 (Event/Manual, 32 primary signals from somewhere). + +## GPU interrupt delivery — the iterate-2.BC delta confirmed + +| Engine | gpu.interrupt.delivered (vsync) | EmulateCPInterruptDPC / vblank pump | +|---|---:|---:| +| **ours** | 54 (source=0) + 1 (source=1) | — | +| **canary** | — | **4712** in 30 s ≈ 157 Hz | + +**~87× ratio.** Confirms HANDOFF's diagnosis: ours' victim-thread injector dies once guest threads all park; canary's host frame-limiter thread keeps firing regardless. + +## Canary signaler attribution + +Top KeSetEvent guest_ptrs in canary (30 s window): + +| guest_ptr | KeSetEvent fires | Inferred role | +|---|---:|---| +| `0x828A3254` | 5729 | Audio host-pump worker (per AUDIT-032: `r3=0x828A3230` region) | +| `0x828A3244` | 5728 | Audio host-pump sibling | +| `0x828A3244` + 16-byte stride | — | Static XEX-image audio event struct | +| `0xBCE25234` | 1301 | **silph UI cluster PKEVENT** (heap-allocated, 0x10 stride). Likely ours' 0x12ac analog. | +| `0xBCE25214 / 0xBCE25244 / 0xBCE25224` | 648 / 603 / 603 | Sibling silph UI PKEVENTs (0x10 stride struct). Likely ours' 0x12a4 / 0x12b8 / 0x1040 analogs. | + +Ours signals every one of those equivalents **0 times**. + +## Round 2 — LR-extended probes name the producer + +Extended the canary probes with guest-LR capture (5 sites in `xboxkrnl_threading.cc`, 10 LOC). Re-ran the harness. Now each `KeSetEvent` line carries the guest function that signaled the event. Result for the silph UI cluster: + +| PKEVENT | KeSetEvent count | Producer LR(s) | +|---|---:|---| +| `0xBCE25214` | 574 | `0x82508510` (single producer) | +| `0xBCE25224` | 565 | `0x82508358` (single producer) | +| `0xBCE25234` | 1153 | `0x82506C90` (579) + `0x82508524` (574) | +| `0xBCE25244` | 570 | `0x82506F9C` (single producer) | +| `0xBCE25284` | 1 | `0x82507ABC` (one-shot 5th-worker init?) | + +All 6 producer LRs sit in `0x82506000–0x82509000`. **This is exactly the `sub_825070F0` worker thread cluster** that audit-057/058 already named: + +> *audit-057: "sub_825070F0 (4 missing, initializes 4 workers w/ shared ctx 0xBCE25340, entries 0x82506528/58/88/B8)"* + +The 4 worker entries (`0x82506528/58/88/B8`) are inside `sub_82506xxx` — exactly where the producer LRs `0x82506C90`/`0x82506F9C` live. The other producer LRs `0x825083xx` / `0x825085xx` are in downstream callees (workers call deeper code which itself calls KeSetEvent). + +For comparison the audio host-pump pair gets a single sharp producer too: +- `0x828A3254` × 5271 ← `lr=0x824D2A44` +- `0x828A3244` × 5271 ← `lr=0x824D292C` + +(These match AUDIT-032's PC `0x824D229C / r3=0x828A3230` region — already-understood audio host-pump.) + +## Verdict — 2.BE is INSUFFICIENT for the silph UI wedge + +The silph UI PKEVENTs are signaled exclusively by threads spawned by `sub_825070F0`. Per audit-057/058, **`sub_825070F0` fires 0× in ours** — those 4 worker threads never spawn. Therefore the PKEVENTs are never signaled. Therefore tid=13 (`0x12ac` in ours) wedges forever. + +**`sub_825070F0`'s call chain is gated by the audit-009 "unreachability island"** — a CRT-driven fnptr-array bootstrap that ours fails to enumerate. VSync delivery is irrelevant to that bootstrap; the host frame-limiter thread does not drive CRT initializers. + +Therefore: +- **2.BE alone CANNOT unwedge tid=13.** It will close the 54-vs-4712 VSync delivery gap and may unblock things downstream of vsync, but the silph UI wedge has an independent missing-signaler root cause. +- **2.BE may still unwedge tid=1 main on `0x12a4`** — that wait went via `KeInitializeEvent` (handle never hit `NtCreateEvent` in ours, hence ``). Whether `0x12a4`'s signaler depends on VSync is unknown without further probing. + +## Implications for next moves + +A single fix won't take us to draws > 0. We need at least two: + +1. **2.BE (VSync delivery)** — still worth landing for the architectural correctness it brings, AND because it's the only fix that can unwedge tid=1 main's `0x12a4` if that's vsync-derived. ~60–80 LOC per Agent C's plan. +2. **2.BF (sub_825070F0 activation)** — this is the audit-058 unfinished business. Options: + - (a) **Static work:** trace canary's CRT-driven fnptr-array path that activates the silph UI bootstrap; backport the missing init into ours. High info, slow. Requires more probing. + - (b) **Direct synthetic spawn:** ours injects host-side `ExCreateThread` calls for the 4 worker entries at boot completion, mirroring AUDIT-048's audio-host-pump precedent. Pragmatic; ~40 LOC; risks getting context (`0xBCE25340`) wrong. + +A possible third move: + +3. **Re-probe with LR on Wait paths** (we already added it but didn't grep for it) — to tell us whether tid=1's wait on `0x12a4` is the same LR as `sub_825070F0`-chain or a totally different signaler. If different, it's a 3rd missing producer. + +## Round 4 — wait-side guest LR via one-frame back-chain walk + +After fixing the PPC stack-walk offset (Xbox 360 stores saved LR at `[prev_sp - 8]`, not the `+4` AIX convention), wait-side LR comes through cleanly. + +**Canary's top wait sites:** + +| canary handle | wait count | guest_lr | LR region | mapping | +|---|---:|---|---|---| +| `F800005C` | 1635 | `0x8216EE14` | kernel early-boot infra | unrelated | +| `F800000C` | 1597 | `0x824AFFC4` | xboxkrnl wrapper (scheduler / work-queue?) | unrelated | +| **`F80000DC`** | **476** | **`0x821C7D3C`** | **silph::UImpl/GamePart** | **= ours' 0x12ac silph UI wedge** | +| `F80000B0` | 6 across | `0x821CBAE0` + `0x821CC19C` + `0x822DFE2x/D0` | **exact match with audit-049's frame trail** | sibling silph UI wait | + +Identity proof: ours' audit-049 frame trail for the silph UI wedge was `0x821cb1e0 / 0x821cbae0 / 0x821cc454 / 0x821c4f18 / 0x82174a80`. Round 4 captures `0x821CBAE0` and `0x821CC19C` (adjacent PCs) as wait LRs in canary — same cluster, same code. + +**Refined verdict.** ours' `0x12a4` (tid=1 main, AUDIT_BLIND) and `0x12ac` (tid=13 silph UI) are 8 bytes apart — likely sibling KEVENT fields in the same silph UI struct. canary's analogs are in the `F80000xx` namespace, similarly clustered. The single fix that addresses both: + +> **2.BF (b)** — synthetic host-side spawn of `sub_825070F0`'s 4 workers at the audit-058-identified context (`0xBCE25340`), entries `0x82506528/58/88/B8`. Once those workers run, they signal the silph UI PKEVENT cluster, unwedging BOTH tid=1 main and tid=13 silph UI in one shot. + +2.BE (host-driven VSync ISR delivery) becomes follow-on work after the UI bootstrap completes and frame pacing actually matters. + +## Open questions for iterate 2.BD′ / 2.BE planning + +1. **Does 2.BE alone unwedge tid=13?** Cheapest verification path: land 2.BE and re-run audit-059, see whether `0x12ac` signal count goes 0 → non-zero. +2. **What is the LR-pattern of canary's `KeSetEvent guest_ptr=0xBCE25234` callers?** The current probe doesn't capture LR — extending the cvar to do so on a filtered subset would let us name the producer function in canary's namespace. +3. **Does the GPU frame-limiter's CP interrupt actually walk into the silph UI cluster?** I.e., does `EmulateCPInterruptDPC` → `interrupt_callback` → guest code ever hit `sub_821CB030` or its callees? An LR probe inside `EmulateCPInterruptDPC` would answer this. + +## Artifacts + +- `canary.log` 2.2 MB / 34,095 lines / 32,977 AUDIT-HLC lines +- `canary.stdout` 2.2 MB (duplicate of canary.log due to log_file fallback) +- `canary.stderr` 8.4 KB (Wine diagnostics) +- `ours.log` 479 lines (focus ledger + thread diagnostics + final state) +- `ours.stderr` 317 lines (kernel-call counters) +- `vkd3d-proton.cache.write` 15 KB (build artifact, ignored) + +Commits in play (xenia-canary, fork-local only): +- `03362b59f` cross-build-wine (cross-compile toolchain) +- `d031d7c51` audit-handle-lifecycle-probes (this audit's probes) diff --git a/audit-runs/audit-059-handle-disambiguation/ROUND_34_PLAN.md b/audit-runs/audit-059-handle-disambiguation/ROUND_34_PLAN.md new file mode 100644 index 0000000..46f70c3 --- /dev/null +++ b/audit-runs/audit-059-handle-disambiguation/ROUND_34_PLAN.md @@ -0,0 +1,116 @@ +# Round 34 — silph_ui_synth.rs (cluster B sibling) — DEFERRED PLAN + +## Background + +Rounds 23-33 drove γ-cluster #2 down to the actual gate: **`sub_821741C8`** (silph worker-dispatch loop) fires 0× in ours / 471× in canary (tid=6). It's invoked via dynamic vtable slot 9 from `sub_821752C0` thunk. The vtable writer is in the audit-050 unreachability island — there's no static caller chain to hook into. + +The fix shape is a synth module analogous to `silph_synth.rs` (rounds 18-21): +- Synthesize a singleton-like object with the right vtable +- Spawn a guest thread at the right entry with this object as r3 +- Let the dispatch chain do the rest + +Rounds 18-21 took 4 rounds to land cluster A's analog and ended at "workers run live but idle" because of missing foreign-pointer fields. Cluster B will face similar challenges. + +## Sub-round breakdown (estimated 5-8 rounds) + +### 34.α — Probe canary's dispatcher singleton (1 round) +Capture canary's runtime state at `sub_821741C8` entry: +- `r3 = 0xBCA44C00` (canary tid=6's dispatcher singleton) +- Dump `r3..r3+0x80` to identify all fields +- Note vtable address at `[r3+0]` + +```bash +WINEDEBUG=-all wine xenia_canary.exe --mute=true --audit_handle_lifecycle=true \ + --audit_jit_prolog_pc=0x821741C8 --audit_jit_prolog_r3_bytes=128 \ + --audit_jit_prolog_mem_dump= \ + ... +``` + +### 34.β — Probe full vtable layout (1 round) +Read the vtable bytes statically from the PE (canary's `[r3+0]` IS a static XEX VA — same trick as round 21): +- Read 32-64 slots from PE at file offset = vtable VA - 0x82000000 +- Confirm slot 9 = `sub_821C7CB8` and `vtable+0x24` thunk to `sub_821741C8` +- Look at all other slots — do any reference deep guest code that needs more init? + +Cross-reference each slot's DB reach. If a slot is the dispatcher's own method body, it'll be called from within the chain — needs to exist. + +### 34.γ — Skeleton synth + thread spawn (1 round) +Create `crates/xenia-kernel/src/silph_ui_synth.rs` mirroring `silph_synth.rs` structure: +```rust +pub fn spawn_silph_ui_dispatcher(state: &mut KernelState, mem: &GuestMemory, scheduler: &mut Scheduler) -> Result { + if state.silph_ui_synth_done { return Ok(state.silph_ui_synth_ctx); } + + // Allocate ~0x100-0x200 bytes for the dispatcher singleton + let ctx = state.heap_alloc(0x200, 16)?; + mem.write_zeros(ctx, 0x200); + + // Install static-XEX vtable at [+0] + mem.write_u32(ctx + 0x00, VTABLE_VA); // discovered in 34.β + + // Other init fields from 34.α dump + // ... + + // Spawn dispatcher thread at sub_821748F0 with r3=ctx + scheduler.spawn(SpawnParams{ + entry: 0x821748F0, + start_context: ctx, + create_suspended: false, + ... + })?; + + state.silph_ui_synth_done = true; + state.silph_ui_synth_ctx = ctx; + Ok(ctx) +} +``` + +Hook point: first reach of `sub_821CB030` in the existing silph factory chain (the call site that should normally trigger this dispatcher's creation in canary). + +Add 3-mode env gate: `XENIA_SILPH_UI_SYNTH={unset|=suspend|=1}`. + +### 34.δ — Run + diagnose first crash (1 round) +Almost certainly crashes on a NULL deref of one of the singleton's fields. Use round 19's pattern: +- Probe at thread entry + early BB heads +- Identify the offset that's accessed +- Compare to canary's value at that offset + +### 34.ε..η — Iterate on field fills (2-4 rounds) +Each crash identifies one more required field. Fill it. Re-run. Continue until workers idle (verdict D analog). + +### 34.θ — Producer-side seeding (1 round) +Even with the dispatcher running, work-items may not flow. Per round 32 it's pool 3 that's starved (271 fires in canary). The producers are `sub_821CBEA8 / sub_821D24A0 / sub_821CD458` — they may need their own bootstrap. Probe what triggers them in canary. + +## Verification at each stage + +After every commit: +- `cargo test --release --workspace` — 765/765 must pass +- `XENIA_CACHE_PERSIST=1 XENIA_SILPH_UI_SYNTH=1 ./target/release/xenia-rs exec -n 50000000 --trace-handles-focus=0x1218,0x1224,0x12a4,0x12ac` +- Check: + - No crash + - `sub_821741C8` fires + - `sub_82450b68` r4=3 fires increase + - Handle 0x1224 / 0x1218 transition out of NO_SIGNALS_DESPITE_WAITS + - Eventually: `VdSwap > 1, draws > 0` + +## Risk register + +- **High**: dispatcher singleton may require many more fields than the analog WorkerCtx (rounds 18-21 needed 8 KEVENTs + ring + descriptors + index table; UI dispatcher likely has similar scope) +- **High**: foreign-arena pointers in canary's heap (similar to round 19's `[+0x28/+0x2C/+0x30]`) may need their own synthesis +- **Medium**: cluster B's worker may itself spawn threads which need contexts which need... cascading scope +- **Low**: workspace tests breaking (probe infrastructure is solid) +- **Low**: existing iterate-2BE work regressing (it's on a separate branch) + +## Off-ramps + +If we hit a wall at any sub-round, the off-ramps are: +1. Land the infrastructure as opt-in (rounds 18-21 pattern) and ship cluster A + cluster B both as opt-in env vars +2. Drop cluster B entirely and PR the iterate-2BE work to master (production-ready architectural fix) +3. Pivot to lockstep diff of inflate function (round 30 hypothesis (i)) if cluster B keeps producing crash-fix layers + +## Branch plan + +New branch: `iterate-2BF/silph-ui-synth` off `iterate-2BF/synthetic-silph-spawn` HEAD `40f208e`. Each sub-round = 1 commit. All commits opt-in via env var; default behavior unchanged. + +## When ready to execute + +Dispatch with the prompt at the round-33 agent's recommendation, starting at sub-round 34.α. diff --git a/audit-runs/audit-059-handle-disambiguation/round27-state-advance/disasm-sub82450B60.txt b/audit-runs/audit-059-handle-disambiguation/round27-state-advance/disasm-sub82450B60.txt new file mode 100644 index 0000000..92f5647 --- /dev/null +++ b/audit-runs/audit-059-handle-disambiguation/round27-state-advance/disasm-sub82450B60.txt @@ -0,0 +1,200 @@ + 0x82450b60: lwz r18, 9792(r31) + 0x82450b64: lwz r16, 13880(r14) + 0x82450b68: mflr r12 + 0x82450b6c: bl 0x825F0F74 + 0x82450b70: subi r31, r1, 176 + 0x82450b74: stwu r1, -176(r1) + 0x82450b78: mr r29, r4 + 0x82450b7c: mr r27, r3 + 0x82450b80: cmpwi cr6, r29, 5 + 0x82450b84: bne cr6, 0x82450B94 + 0x82450b88: addi r28, r27, 196 + 0x82450b8c: addi r26, r27, 28 + 0x82450b90: b 0x82450BAC + 0x82450b94: slwi r11, r29, 2 + 0x82450b98: mr r26, r27 + 0x82450b9c: add r11, r29, r11 + 0x82450ba0: slwi r11, r11, 2 + 0x82450ba4: add r11, r11, r27 + 0x82450ba8: addi r28, r11, 96 + 0x82450bac: addi r23, r27, 56 + 0x82450bb0: mr r3, r23 + 0x82450bb4: stw r23, 84(r31) + 0x82450bb8: bl 0x8284DCFC + 0x82450bbc: mr r3, r26 + 0x82450bc0: bl 0x8284DCFC + 0x82450bc4: lwz r7, 16(r28) + 0x82450bc8: cntlzw r11, r7 + 0x82450bcc: extrwi r11, r11, 1, 26 + 0x82450bd0: cmplwi cr6, r11, 0x0 + 0x82450bd4: beq cr6, 0x82450BEC + 0x82450bd8: mr r3, r26 + 0x82450bdc: bl 0x8284DD0C + 0x82450be0: mr r3, r23 + 0x82450be4: bl 0x8284DD0C + 0x82450be8: b 0x82450EE8 + 0x82450bec: lwz r11, 12(r28) + 0x82450bf0: lwz r9, 8(r28) + 0x82450bf4: srwi r10, r11, 2 + 0x82450bf8: clrlwi r8, r11, 30 + 0x82450bfc: cmplw cr6, r9, r10 + 0x82450c00: bgt cr6, 0x82450C08 + 0x82450c04: sub r10, r10, r9 + 0x82450c08: lwz r9, 4(r28) + 0x82450c0c: slwi r10, r10, 2 + 0x82450c10: slwi r8, r8, 2 + 0x82450c14: lwz r6, 8(r28) + 0x82450c18: addi r11, r11, 1 + 0x82450c1c: slwi r6, r6, 2 + 0x82450c20: li r24, 0 + 0x82450c24: lwzx r10, r10, r9 + 0x82450c28: cmplw cr6, r6, r11 + 0x82450c2c: lwzx r30, r10, r8 + 0x82450c30: stw r11, 12(r28) + 0x82450c34: stw r30, 80(r31) + 0x82450c38: bgt cr6, 0x82450C40 + 0x82450c3c: stw r24, 12(r28) + 0x82450c40: subic. r11, r7, 1 + 0x82450c44: stw r11, 16(r28) + 0x82450c48: bne 0x82450C50 + 0x82450c4c: stw r24, 12(r28) + 0x82450c50: addi r25, r27, 28 + 0x82450c54: mr r3, r25 + 0x82450c58: bl 0x8284DCFC + 0x82450c5c: mr r3, r25 + 0x82450c60: stw r30, 216(r27) + 0x82450c64: bl 0x8284DD0C + 0x82450c68: mr r3, r26 + 0x82450c6c: bl 0x8284DD0C + 0x82450c70: lwz r11, 28(r30) + 0x82450c74: clrlwi r11, r11, 31 + 0x82450c78: cmplwi cr6, r11, 0x0 + 0x82450c7c: bne cr6, 0x82450D30 + 0x82450c80: lwz r11, 8(r30) + 0x82450c84: cmplwi cr6, r11, 0x1 + 0x82450c88: blt cr6, 0x82450CE4 + 0x82450c8c: bne cr6, 0x82450D3C + 0x82450c90: lwz r11, 28(r30) + 0x82450c94: rlwinm r11, r11, 0, 29, 29 + 0x82450c98: cmplwi cr6, r11, 0x0 + 0x82450c9c: beq cr6, 0x82450CB0 + 0x82450ca0: mr r4, r30 + 0x82450ca4: mr r3, r27 + 0x82450ca8: bl 0x824510E0 + 0x82450cac: b 0x82450CBC + 0x82450cb0: mr r4, r30 + 0x82450cb4: mr r3, r27 + 0x82450cb8: bl 0x824517B0 + 0x82450cbc: stw r29, 220(r27) + 0x82450cc0: bl 0x824AA830 + 0x82450cc4: mr r11, r3 + 0x82450cc8: lwz r3, 92(r27) + 0x82450ccc: li r5, 0 + 0x82450cd0: addi r11, r11, 66 + 0x82450cd4: li r4, 1 + 0x82450cd8: stw r11, 224(r27) + 0x82450cdc: bl 0x824AB158 + 0x82450ce0: b 0x82450D3C + 0x82450ce4: lwz r11, 28(r30) + 0x82450ce8: mr r4, r30 + 0x82450cec: mr r3, r27 + 0x82450cf0: rlwinm r11, r11, 0, 29, 29 + 0x82450cf4: cmplwi cr6, r11, 0x0 + 0x82450cf8: beq cr6, 0x82450D04 + 0x82450cfc: bl 0x82450F68 + 0x82450d00: b 0x82450D08 + 0x82450d04: bl 0x82451238 + 0x82450d08: stw r29, 220(r27) + 0x82450d0c: bl 0x824AA830 + 0x82450d10: mr r11, r3 + 0x82450d14: lwz r3, 92(r27) + 0x82450d18: li r5, 0 + 0x82450d1c: addi r11, r11, 66 + 0x82450d20: li r4, 1 + 0x82450d24: stw r11, 224(r27) + 0x82450d28: bl 0x824AB158 + 0x82450d2c: b 0x82450D3C + 0x82450d30: lwz r11, 28(r30) + 0x82450d34: ori r11, r11, 0x2 + 0x82450d38: stw r11, 28(r30) + 0x82450d3c: lwz r11, 8(r30) + 0x82450d40: mr r29, r24 + 0x82450d44: cmpwi cr6, r11, 2 + 0x82450d48: blt cr6, 0x82450E08 + 0x82450d4c: cmpwi cr6, r11, 3 + 0x82450d50: ble cr6, 0x82450DA0 + 0x82450d54: cmpwi cr6, r11, 4 + 0x82450d58: bne cr6, 0x82450E08 + 0x82450d5c: lwz r11, 28(r30) + 0x82450d60: rlwinm r11, r11, 0, 29, 29 + 0x82450d64: cmplwi cr6, r11, 0x0 + 0x82450d68: bne cr6, 0x82450D98 + 0x82450d6c: lwz r29, 36(r30) + 0x82450d70: mr r3, r29 + 0x82450d74: lwz r11, 0(r29) + 0x82450d78: lwz r11, 4(r11) + 0x82450d7c: mtctr r11 + 0x82450d80: bctrl + 0x82450d84: clrlwi r11, r3, 24 + 0x82450d88: cmplwi cr6, r11, 0x0 + 0x82450d8c: beq cr6, 0x82450D98 + 0x82450d90: mr r3, r29 + 0x82450d94: bl 0x8244FB38 + 0x82450d98: li r29, 1 + 0x82450d9c: b 0x82450E28 + 0x82450da0: addi r3, r30, 40 + 0x82450da4: bl 0x82451DB8 + 0x82450da8: lwz r11, 32(r30) + 0x82450dac: cmplwi cr6, r11, 0x0 + 0x82450db0: beq cr6, 0x82450DCC + 0x82450db4: rlwinm r11, r11, 0, 0, 31 + 0x82450db8: lwz r10, 4(r30) + 0x82450dbc: lwz r11, 4(r11) + 0x82450dc0: cmplw cr6, r10, r11 + 0x82450dc4: li r11, 1 + 0x82450dc8: beq cr6, 0x82450DD0 + 0x82450dcc: mr r11, r24 + 0x82450dd0: clrlwi r11, r11, 24 + 0x82450dd4: cmplwi cr6, r11, 0x0 + 0x82450dd8: beq cr6, 0x82450E00 + 0x82450ddc: lwz r4, 8(r30) + 0x82450de0: lwz r5, 0(r30) + 0x82450de4: lwz r3, 32(r30) + 0x82450de8: cmpwi cr6, r4, 1 + 0x82450dec: ble cr6, 0x82450DFC + 0x82450df0: bl 0x8245D9D8 + 0x82450df4: li r29, 1 + 0x82450df8: b 0x82450E28 + 0x82450dfc: stw r4, 8(r3) + 0x82450e00: li r29, 1 + 0x82450e04: b 0x82450E28 + 0x82450e08: mr r3, r26 + 0x82450e0c: stw r26, 88(r31) + 0x82450e10: bl 0x8284DCFC + 0x82450e14: addi r4, r31, 80 + 0x82450e18: mr r3, r28 + 0x82450e1c: bl 0x823232C0 + 0x82450e20: mr r3, r26 + 0x82450e24: bl 0x8284DD0C + 0x82450e28: clrlwi r11, r29, 24 + 0x82450e2c: cmplwi cr6, r11, 0x0 + 0x82450e30: beq cr6, 0x82450ECC + 0x82450e34: lwz r11, 28(r30) + 0x82450e38: rlwinm r11, r11, 0, 30, 30 + 0x82450e3c: cmplwi cr6, r11, 0x0 + 0x82450e40: beq cr6, 0x82450E68 + 0x82450e44: mr r3, r26 + 0x82450e48: stw r26, 88(r31) + 0x82450e4c: bl 0x8284DCFC + 0x82450e50: addi r4, r31, 80 + 0x82450e54: mr r3, r28 + 0x82450e58: bl 0x823232C0 + 0x82450e5c: mr r3, r26 + 0x82450e60: bl 0x8284DD0C + 0x82450e64: b 0x82450ECC + 0x82450e68: lwz r11, 40(r30) + 0x82450e6c: cmplwi cr6, r11, 0x0 + 0x82450e70: beq cr6, 0x82450EA4 + 0x82450e74: rlwinm r3, r11, 0, 0, 31 + 0x82450e78: bl 0x82458A70 + 0x82450e7c: lwz r29, 40(r30) diff --git a/audit-runs/audit-059-handle-disambiguation/round27-state-advance/disasm-sub82451238.txt b/audit-runs/audit-059-handle-disambiguation/round27-state-advance/disasm-sub82451238.txt new file mode 100644 index 0000000..776de54 --- /dev/null +++ b/audit-runs/audit-059-handle-disambiguation/round27-state-advance/disasm-sub82451238.txt @@ -0,0 +1,80 @@ + 0x82451238: mflr r12 + 0x8245123c: li r0, 0 + 0x82451240: stw r0, 4(r1) + 0x82451244: bl 0x825F0F80 + 0x82451248: subi r31, r1, 160 + 0x8245124c: stwu r1, -160(r1) + 0x82451250: mr r30, r4 + 0x82451254: li r9, 1 + 0x82451258: lwz r10, 32(r30) + 0x8245125c: stw r30, 188(r31) + 0x82451260: stw r9, 8(r30) + 0x82451264: cmplwi cr6, r10, 0x0 + 0x82451268: beq cr6, 0x82451288 + 0x8245126c: lwz r11, 4(r30) + 0x82451270: lwz r8, 4(r10) + 0x82451274: cmplw cr6, r11, r8 + 0x82451278: bne cr6, 0x82451288 + 0x8245127c: mr r11, r9 + 0x82451280: li r26, 0 + 0x82451284: b 0x82451290 + 0x82451288: li r26, 0 + 0x8245128c: mr r11, r26 + 0x82451290: clrlwi r11, r11, 24 + 0x82451294: cmplwi cr6, r11, 0x0 + 0x82451298: beq cr6, 0x824512A0 + 0x8245129c: stw r9, 8(r10) + 0x824512a0: lwz r3, 36(r30) + 0x824512a4: lwz r11, 0(r3) + 0x824512a8: lwz r11, 32(r11) + 0x824512ac: mtctr r11 + 0x824512b0: bctrl + 0x824512b4: mr r27, r3 + 0x824512b8: stw r26, 84(r31) + 0x824512bc: stw r27, 96(r31) + 0x824512c0: bl 0x82454498 + 0x824512c4: addi r4, r31, 84 + 0x824512c8: bl 0x82454580 + 0x824512cc: stw r26, 92(r31) + 0x824512d0: addi r11, r27, 2047 + 0x824512d4: lis r10, 0x2 + 0x824512d8: clrrwi r11, r11, 11 + 0x824512dc: cmplw cr6, r11, r10 + 0x824512e0: stw r11, 100(r31) + 0x824512e4: ble cr6, 0x824512F4 + 0x824512e8: lis r11, 0x8207 + 0x824512ec: addi r11, r11, 6724 + 0x824512f0: b 0x824512F8 + 0x824512f4: addi r11, r31, 100 + 0x824512f8: addi r3, r31, 84 + 0x824512fc: lwz r4, 0(r11) + 0x82451300: bl 0x82454B08 + 0x82451304: mr r8, r8 + 0x82451308: mr r28, r3 + 0x8245130c: stw r28, 92(r31) + 0x82451310: b 0x82451324 + 0x82451314: lwz r30, 188(r31) + 0x82451318: lwz r27, 96(r31) + 0x8245131c: li r26, 0 + 0x82451320: lwz r28, 92(r31) + 0x82451324: addi r3, r31, 84 + 0x82451328: bl 0x82454AA0 + 0x8245132c: mr r29, r3 + 0x82451330: cmplwi cr6, r28, 0x0 + 0x82451334: beq cr6, 0x82451684 + 0x82451338: lwz r3, 36(r30) + 0x8245133c: li r8, 0 + 0x82451340: addi r7, r31, 88 + 0x82451344: mr r6, r29 + 0x82451348: mr r5, r29 + 0x8245134c: mr r4, r28 + 0x82451350: lwz r11, 0(r3) + 0x82451354: lwz r11, 28(r11) + 0x82451358: mtctr r11 + 0x8245135c: bctrl + 0x82451360: clrlwi r11, r3, 24 + 0x82451364: cmplwi cr6, r11, 0x0 + 0x82451368: beq cr6, 0x82451684 + 0x8245136c: lwz r11, 28(r30) + 0x82451370: rlwinm r11, r11, 0, 28, 28 + 0x82451374: cmplwi cr6, r11, 0x0 diff --git a/audit-runs/audit-059-handle-disambiguation/round35-lockstep-inflate/diff.out b/audit-runs/audit-059-handle-disambiguation/round35-lockstep-inflate/diff.out new file mode 100644 index 0000000..192db52 --- /dev/null +++ b/audit-runs/audit-059-handle-disambiguation/round35-lockstep-inflate/diff.out @@ -0,0 +1,52 @@ +=== Fire counts === + ours: 3 + canary: 7 + +=== Per-LR breakdown === + ours: + lr=0x82458674: 3 + canary: + lr=0x82457bd4: 2 + lr=0x82458674: 5 + +=== Side-by-side first 5 fires (entry registers) === + +--- fire #0 --- + ours: tid=6 cycle=363 lr=0x82458674 r3=0x40ba9ac0 + dump: 419fecda 000007f6 00000000 41d7dd10 00001688 00000000 00000000 41f5dd80 82457958 823f53f0 00000000 00000000 00000001 00000000 00000000 4024a5c0 + canary: tid=11 cycle= lr=0x82458674 r3=0xbccc4ac0 r4=0x00000000 r5=0x00000001 r6=0x00000001 r7=0x00000000 + dump: bdb19cda 000007f6 00000000 bde98d10 00001688 00000000 00000000 be078d80 82457958 823f53f0 00000000 00000000 00000001 00000000 00000000 bc365760 + +--- fire #1 --- + ours: tid=6 cycle=140548 lr=0x82458674 r3=0x40ba9b80 + dump: 42c0f09a 00018ff6 00000000 43777210 0004d055 00000000 00000000 41f60d80 82457958 823f53f0 00000000 00000000 00000001 00000000 00000000 4024a960 + canary: tid=11 cycle= lr=0x82458674 r3=0xbccc4b80 r4=0x00000000 r5=0x00000001 r6=0x00000001 r7=0x00000000 + dump: bed2a09a 00018ff6 00000000 bf892210 0004d055 00000000 00000000 be07bd80 82457958 823f53f0 00000000 00000000 00000001 00000000 00000000 bc365840 + +--- fire #2 --- + ours: tid=6 cycle=5957876 lr=0x82458674 r3=0x40ba9b80 + dump: 419fecda 000007f6 00000000 414f5f70 000003b9 00000000 00000000 41f60d80 82457958 823f53f0 00000000 00000040 00000001 00000000 00000000 4024a980 + canary: tid=11 cycle= lr=0x82458674 r3=0xbccc4b80 r4=0x00000000 r5=0x00000001 r6=0x00000001 r7=0x00000000 + dump: bdb19cda 000007f6 00000000 bd610b90 000003b9 00000000 00000000 be07bd80 82457958 823f53f0 00000000 00000040 00000001 00000000 00000000 bc365860 + +--- fire #3 --- + ours: + canary: tid=11 cycle= lr=0x82458674 r3=0xbccc5300 r4=0x00000000 r5=0x00000001 r6=0x00000001 r7=0x00000000 + dump: bdb1acda 000007f6 00000000 bce24ed0 00000167 00000000 00000000 be07bd80 82457958 823f53f0 00000000 00000000 00000001 00000000 00000000 bc365f40 + +--- fire #4 --- + ours: + canary: tid=6 cycle= lr=0x82457bd4 r3=0x701cf3c0 r4=0x00000004 r5=0x00002530 r6=0x00008000 r7=0x00000001 + dump: be95af9a 0000c170 00000000 b2050010 000681e9 00000000 00000000 be07bd80 82457958 823f53f0 00000000 0000c17a 00000001 701cf4e0 00000000 be95af90 + +=== Equivalence check: u32 lanes at +0x04 and +0x10 (work-item magic + counter) === + Both fields are stable identifiers across engines (host VAs differ but data should match). + + Index of fields: + [+0x04] = work-item 'size?' (looks like a length field) + [+0x10] = state counter (per round 30, this is [+128/4 ?]) — but in dump it's u32[4] + + ours [+04,+10]: [(2038, 5768), (102390, 315477), (2038, 953)] + canary [+04,+10]: [(2038, 5768), (102390, 315477), (2038, 953), (2038, 359), (49520, 426473), (232195, 999643), (6134, 13763)] + + ours fires whose [+04,+10] match a canary fire: 3/3 diff --git a/audit-runs/audit-059-handle-disambiguation/round35-lockstep-inflate/diff.py b/audit-runs/audit-059-handle-disambiguation/round35-lockstep-inflate/diff.py new file mode 100644 index 0000000..e81ee10 --- /dev/null +++ b/audit-runs/audit-059-handle-disambiguation/round35-lockstep-inflate/diff.py @@ -0,0 +1,175 @@ +#!/usr/bin/env python3 +"""Round 35 lockstep diff: align sub_8280AD40 entry fires between +ours (--audit-pc-probe-hex AUDIT-PC-PROBE / AUDIT-R3-DUMP) and +canary (AUDIT-HLC JitProlog). + +Outputs side-by-side rendering of: + - per-fire entry register snapshot (r3..r10, lr) + - 64-byte r3 dump (u32 lanes, big-endian) +Alignment is by tid + invocation order (no input-equivalence required). +""" +import re +import sys +import os + +THIS_DIR = os.path.dirname(os.path.abspath(__file__)) +OURS_LOG = os.path.join(THIS_DIR, "ours.log") +CANARY_LOG = os.path.join( + os.path.dirname(THIS_DIR), "round35-lockstep-inflate-canary", "canary.log" +) + +PC_TARGET = 0x8280AD40 + + +def parse_ours(path): + """Pair AUDIT-PC-PROBE lines with their following AUDIT-R3-DUMP lines.""" + fires = [] + cur = None + with open(path) as f: + for line in f: + line = line.strip() + if line.startswith("AUDIT-PC-PROBE"): + m = re.search( + r"pc=0x([0-9a-f]+) tid=(\d+) hw=\d+ cycle=(\d+) lr=0x([0-9a-f]+) r3=0x([0-9a-f]+) r11=0x([0-9a-f]+)", + line, + ) + if not m: + continue + pc = int(m.group(1), 16) + if pc != PC_TARGET: + cur = None + continue + cur = { + "tid": int(m.group(2)), + "cycle": int(m.group(3)), + "lr": int(m.group(4), 16), + "r3": int(m.group(5), 16), + "dump": [], + } + fires.append(cur) + elif line.startswith("AUDIT-R3-DUMP") and cur is not None: + lanes = re.findall(r"\+0x[0-9a-f]+=0x([0-9a-f]+)", line) + cur["dump"] = [int(x, 16) for x in lanes] + cur = None + return fires + + +def parse_canary(path): + """Pair AUDIT-HLC JitProlog header lines with following r3+NN dump lines.""" + fires = [] + cur = None + hdr_re = re.compile( + r"AUDIT-HLC JitProlog pc=8280AD40 tid=([0-9A-F]+) r3=([0-9A-F]+) r4=([0-9A-F]+) " + r"r5=([0-9A-F]+) r6=([0-9A-F]+) r7=([0-9A-F]+) r8=([0-9A-F]+) r9=([0-9A-F]+) r10=([0-9A-F]+) lr=([0-9A-F]+)" + ) + dump_re = re.compile( + r"AUDIT-HLC JitProlog pc=8280AD40 r3\+([0-9A-F]+): ([0-9A-F]+) ([0-9A-F]+) ([0-9A-F]+) ([0-9A-F]+)" + ) + with open(path) as f: + for line in f: + line = line.strip() + m = hdr_re.search(line) + if m: + cur = { + "tid": int(m.group(1), 16), + "r3": int(m.group(2), 16), + "r4": int(m.group(3), 16), + "r5": int(m.group(4), 16), + "r6": int(m.group(5), 16), + "r7": int(m.group(6), 16), + "r8": int(m.group(7), 16), + "r9": int(m.group(8), 16), + "r10": int(m.group(9), 16), + "lr": int(m.group(10), 16), + "dump": [], + } + fires.append(cur) + continue + m = dump_re.search(line) + if m and cur is not None: + off = int(m.group(1), 16) + for i in range(4): + word = int(m.group(2 + i), 16) + # extend dump to fit + idx = off // 4 + i + while len(cur["dump"]) <= idx: + cur["dump"].append(0) + cur["dump"][idx] = word + return fires + + +def fmt_dump(d): + return " ".join(f"{w:08x}" for w in d[:16]) + + +def main(): + ours = parse_ours(OURS_LOG) + canary = parse_canary(CANARY_LOG) + + print(f"=== Fire counts ===") + print(f" ours: {len(ours)}") + print(f" canary: {len(canary)}") + print() + + print(f"=== Per-LR breakdown ===") + for label, fires in (("ours", ours), ("canary", canary)): + lr_counts = {} + for f in fires: + lr_counts[f["lr"]] = lr_counts.get(f["lr"], 0) + 1 + print(f" {label}:") + for lr, n in sorted(lr_counts.items()): + print(f" lr=0x{lr:08x}: {n}") + print() + + print(f"=== Side-by-side first 5 fires (entry registers) ===") + n = max(len(ours), len(canary)) + n = min(n, 5) + for i in range(n): + print(f"\n--- fire #{i} ---") + if i < len(ours): + f = ours[i] + print( + f" ours: tid={f['tid']:<3} cycle={f['cycle']:<10} lr=0x{f['lr']:08x} r3=0x{f['r3']:08x}" + ) + print(f" dump: {fmt_dump(f['dump'])}") + else: + print(f" ours: ") + if i < len(canary): + f = canary[i] + print( + f" canary: tid={f['tid']:<3} cycle= lr=0x{f['lr']:08x} r3=0x{f['r3']:08x} " + f"r4=0x{f['r4']:08x} r5=0x{f['r5']:08x} r6=0x{f['r6']:08x} r7=0x{f['r7']:08x}" + ) + print(f" dump: {fmt_dump(f['dump'])}") + else: + print(f" canary: ") + + print() + print("=== Equivalence check: u32 lanes at +0x04 and +0x10 (work-item magic + counter) ===") + print(" Both fields are stable identifiers across engines (host VAs differ but data should match).") + print() + print(" Index of fields:") + print(" [+0x04] = work-item 'size?' (looks like a length field)") + print(" [+0x10] = state counter (per round 30, this is [+128/4 ?]) — but in dump it's u32[4]") + print() + # +0x04 is dump[1], +0x10 is dump[4] + ours_keys = [(f["dump"][1], f["dump"][4]) if len(f["dump"]) > 4 else None for f in ours] + canary_keys = [(f["dump"][1], f["dump"][4]) if len(f["dump"]) > 4 else None for f in canary] + print(f" ours [+04,+10]: {ours_keys}") + print(f" canary [+04,+10]: {canary_keys}") + print() + # Cross-match: every ours key should appear in canary (canary is a superset) + matched = [] + unmatched_ours = [] + for k in ours_keys: + if k in canary_keys: + matched.append(k) + else: + unmatched_ours.append(k) + print(f" ours fires whose [+04,+10] match a canary fire: {len(matched)}/{len(ours)}") + if unmatched_ours: + print(f" ours fires with NO canary match: {unmatched_ours}") + + +if __name__ == "__main__": + main() diff --git a/audit-runs/audit-059-handle-disambiguation/round36-dispatcher-ctx/first-fire.txt b/audit-runs/audit-059-handle-disambiguation/round36-dispatcher-ctx/first-fire.txt new file mode 100644 index 0000000..c583f94 --- /dev/null +++ b/audit-runs/audit-059-handle-disambiguation/round36-dispatcher-ctx/first-fire.txt @@ -0,0 +1,17 @@ +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 tid=00000006 r3=BCCC4A80 r4=00000018 r5=828F3888 r6=701CF924 r7=82456F00 r8=00000000 r9=00000000 r10=00000018 lr=822F1D5C +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+00: BC22C910 00010004 00000000 000003E8 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+10: 0101FFFF 00000000 00000000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+20: FFFFFFFF 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+30: 00000000 BC365BC0 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+40: 00000000 00000000 00000000 BDE9A398 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+50: BC365560 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+60: 00000000 00000000 00000000 01010040 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+70: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+80: 00000000 00000000 00000000 BC22C930 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+90: 00000000 00000001 00000800 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+A0: F800004C 00000000 00000000 BC365220 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+B0: BC3655C0 00000000 00000000 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+C0: 00CC0048 00460020 00460072 00650071 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+D0: 00750065 006E0063 00790000 01010000 +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+E0: 00000000 00000000 00000000 FFFFFFFF +K> F8000008 AUDIT-HLC JitProlog pc=821741C8 r3+F0: 00000000 00000000 00000000 BD610B80 diff --git a/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.log.run1 b/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.log.run1 new file mode 100644 index 0000000..83df1c0 --- /dev/null +++ b/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.log.run1 @@ -0,0 +1,33989 @@ +i> 000000E0 Build: canary_experimental@99fd19d02 on Jun 5 2026 +i> 000000E0 Storage root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug +i> 000000E0 ----------- CONFIG DUMP ----------- + +[APU] +apu = "any" +apu_max_queued_frames = 8 +enable_xmp = true +ffmpeg_verbose = false +mute = false +use_dedicated_xma_thread = true +xma_decoder = "new" + +[Auditing] +audit_handle_lifecycle = false +audit_jit_prolog_pc = 0 + +[CPU] +break_condition_gpr = -1 +break_condition_op = "eq" +break_condition_truncate = true +break_condition_value = 0 +break_on_debugbreak = true +break_on_instruction = 0 +break_on_start = false +break_on_unimplemented_instructions = true +clock_no_scaling = false +clock_source_raw = false +cpu = "any" +debug_symbol_loader = false +debugprint_trap_log = false +disable_context_promotion = false +disable_instruction_infocache = false +disable_prefetch_and_cachecontrol = true +disassemble_functions = false +dump_translated_hir_functions = false +elide_e0_check = false +emit_inline_mmio_checks = false +emit_mmio_aware_stores_for_recorded_exception_addresses = true +emit_source_annotations = false +enable_early_precompilation = false +full_optimization_even_with_debug = false +ignore_trap_instructions = true +ignore_undefined_externs = true +inline_loadclock = false +inline_mmio_access = true +load_module_map = "" +no_reserved_ops = false +no_round_to_single = false +permit_float_constant_evaluation = false +pvr = 7407360 +record_mmio_access_exceptions = true +store_all_context_values = false +trace_function_coverage = false +trace_function_data = false +trace_function_data_path = "" +trace_function_references = false +trace_functions = false +use_fast_dot_product = false +validate_hir = false +writable_code_segments = false + +[Config] +defaults_date = 2026040912 + +[Content] +license_mask = 0 + +[D3D12] +d3d12_adapter = -1 +d3d12_allow_variable_refresh_rate_and_tearing = true +d3d12_bindless = true +d3d12_break_on_error = false +d3d12_break_on_warning = false +d3d12_debug = false +d3d12_dxbc_disasm = false +d3d12_dxbc_disasm_dxilconv = false +d3d12_pipeline_creation_threads = -1 +d3d12_queue_priority = 1 +d3d12_submit_on_primary_buffer_end = true +d3d12_tessellation_wireframe = false + +[Display] +fullscreen = false +host_present_from_non_ui_thread = true +postprocess_antialiasing = "" +postprocess_dither = true +postprocess_ffx_cas_additional_sharpness = 0 +postprocess_ffx_fsr_max_upsampling_passes = 4 +postprocess_ffx_fsr_sharpness_reduction = 0.20000000298023224 +postprocess_scaling_and_sharpening = "" +present_letterbox = true +present_render_pass_clear = true +present_safe_area_x = 100 +present_safe_area_y = 100 + +[GPU] +anisotropic_override = -1 +async_shader_compilation = true +clear_memory_page_state = false +depth_float24_convert_in_pixel_shader = false +depth_float24_round = false +depth_transfer_not_equal_test = true +disassemble_pm4 = false +draw_resolution_scale_x = 1 +draw_resolution_scale_y = 1 +draw_resolution_scaled_texture_offsets = true +dump_shaders = "" +dxbc_source_map = false +dxbc_switch = true +execute_unclipped_draw_vs_on_cpu = true +execute_unclipped_draw_vs_on_cpu_for_psi_render_backend = true +execute_unclipped_draw_vs_on_cpu_with_scissor = false +force_convert_line_loops_to_strips = false +force_convert_quad_lists_to_triangle_lists = false +force_convert_triangle_fans_to_lists = false +framerate_limit = 0 +gamma_render_target_as_unorm16 = true +gpu = "any" +gpu_3d_to_2d_texture = true +gpu_allow_invalid_fetch_constants = true +gpu_allow_invalid_upload_range = false +half_pixel_offset = true +ignore_32bit_vertex_index_support = false +log_guest_driven_gpu_register_written_values = false +log_ringbuffer_kickoff_initiator_bts = false +mrt_edram_used_range_clamp_to_min = true +native_2x_msaa = true +native_stencil_value_output = true +native_stencil_value_output_d3d12_intel = false +no_discard_stencil_in_transfer_pipelines = false +non_seamless_cube_map = true +occlusion_query = "fast" +occlusion_query_fake_lower_threshold = 80 +occlusion_query_fake_upper_threshold = 100 +occlusion_query_querybatch_range = 0 +occlusion_query_saturation = 1 +primitive_processor_cache_min_indices = 4096 +readback_memexport = false +readback_resolve = "none" +render_target_path_d3d12 = "" +render_target_path_vulkan = "" +resolve_resolution_scale_fill_half_pixel_offset = true +snorm16_render_target_full_range = true +store_shaders = true +target_trace_file = "" +texture_cache_memory_limit_hard = 768 +texture_cache_memory_limit_render_to_texture = 24 +texture_cache_memory_limit_soft = 384 +texture_cache_memory_limit_soft_lifetime = 30 +tiled_shared_memory = true +trace_dump_path = "" +trace_gpu_prefix = "scratch/gpu/" +trace_gpu_stream = false +use_fuzzy_alpha_epsilon = false +vsync = true + +[General] +allow_game_relative_writes = false +allow_plugins = false +apply_patches = true +controller_hotkeys = false +debug = false +disable_doubleclick_fullscreen = false +discord = true +launch_module = "" +notification_sound_path = "" +priority_class = 0 +recent_titles_entry_amount = 10 +time_scalar = 1 + +[HACKS] +ac6_ground_fix = false + +[HID] +guide_button = true +hid = "any" +keyboard_mode = 0 +keyboard_user_index = 0 +left_stick_deadzone_percentage = 0 +right_stick_deadzone_percentage = 0 +vibration = true + +[HID.WinKey] +keybind_a = "0xBA" +keybind_b = "0xDE" +keybind_back = "Z" +keybind_dpad_down = "^S" +keybind_dpad_left = "^A" +keybind_dpad_right = "^D" +keybind_dpad_up = "^W" +keybind_guide = "0x08" +keybind_left_shoulder = "1" +keybind_left_thumb = "F" +keybind_left_thumb_down = "_S" +keybind_left_thumb_left = "_A" +keybind_left_thumb_right = "_D" +keybind_left_thumb_up = "_W" +keybind_left_trigger = "Q I" +keybind_right_shoulder = "3" +keybind_right_thumb = "K" +keybind_right_thumb_down = "0x28" +keybind_right_thumb_left = "0x25" +keybind_right_thumb_right = "0x27" +keybind_right_thumb_up = "0x26" +keybind_right_trigger = "E O" +keybind_start = "X" +keybind_x = "L" +keybind_y = "P" + +[Kernel] +allow_avatar_initialization = false +allow_incompatible_title_update = true +apply_title_update = true +cl = "" +console_type = 0 +default_achievements_backend = "GPD" +ignore_thread_affinities = true +ignore_thread_priorities = false +kernel_build_version = 1888 +kernel_cert_monitor = false +kernel_debug_monitor = false +kernel_display_gamma_power = 2.22222233 +kernel_display_gamma_type = 2 +kernel_pix = false +staging_mode = false + +[Logging] +enable_console = false +flush_log = true +log_file = "" +log_high_frequency_kernel_calls = false +log_level = 2 +log_mask = 0 +log_string_format_kernel_calls = false +log_to_debugprint = false +log_to_stdout = true + +[Memory] +ignore_offset_for_ranged_allocations = false +protect_on_release = false +protect_zero = true +scribble_heap = false +scribble_heap_value = 0 +writable_executable_memory = true + +[Profiles] +logged_profile_slot_0_xuid = "" +logged_profile_slot_1_xuid = "" +logged_profile_slot_2_xuid = "" +logged_profile_slot_3_xuid = "" + +[SDL] +mappings_file = "gamecontrollerdb.txt" + +[Storage] +cache_root = "" +content_root = "" +force_mount_devkit = false +mount_cache = true +mount_memory_unit = false +mount_scratch = false +storage_root = "" + +[UI] +custom_font_path = "" +font_size = 14 +headless = false +imgui_debug = false +profiler_dpi_scaling = false +show_achievement_notification = false +show_profiler = false +storage_selection_dialog = false +window_size_x = 1280 +window_size_y = 720 + +[Video] +avpack = 8 +custom_internal_display_resolution_x = 0 +custom_internal_display_resolution_y = 0 +enable_3d_mode = false +interlaced = false + +[Vulkan] +vulkan_allow_present_mode_fifo_relaxed = true +vulkan_allow_present_mode_immediate = true +vulkan_allow_present_mode_mailbox = true +vulkan_device = -1 +vulkan_log_debug_messages = true +vulkan_pipeline_creation_threads = -1 +vulkan_semaphore_reuse_workaround = false +vulkan_sparse_shared_memory = true +vulkan_validation = false + +[Win32] +win32_high_resolution_timer = true +win32_mmcss = true + +[x64] +align_all_basic_blocks = 0 +delay_via_maybeyield = false +enable_host_guest_stack_synchronization = true +enable_incorrect_roundingmode_behavior = false +enable_rmw_context_merging = false +instrument_call_times = false +max_stackpoints = 65536 +x64_extension_mask = -1 +xop_arithmetic_right_shifts = false +xop_compares = true +xop_left_shifts = false +xop_right_shifts = false +xop_rotates = false +----------- END OF CONFIG DUMP ---- +i> 000000E0 Loaded config: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\xenia-canary.config.toml +i> 000000E0 Content root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\content +i> 000000E0 Host cache root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\cache_host +w> 000000E0 Unable to load Japanese font; JP characters will be boxes +w> 000000E0 Unable to load Japanese font; JP characters will be boxes +i> 0000013C Setup: Initializing Memory... +i> 0000013C Setup: Initializing Exports... +i> 0000013C Setup: Initializing Processor... +i> 0000013C Setup: Initializing Audio... +i> 0000013C Setup: Initializing Graphics... +i> 0000013C Setup: Initializing HID... +i> 0000013C winkey: "0x08" binds key 0x8 to controller input GUIDE. +i> 0000013C winkey: "^A" binds key 0x41 to controller input DPAD_LEFT. +i> 0000013C winkey: "^D" binds key 0x44 to controller input DPAD_RIGHT. +i> 0000013C winkey: "^S" binds key 0x53 to controller input DPAD_DOWN. +i> 0000013C winkey: "^W" binds key 0x57 to controller input DPAD_UP. +i> 0000013C winkey: "_A" binds key 0x41 to controller input LEFT_THUMB_LEFT. +i> 0000013C winkey: "_D" binds key 0x44 to controller input LEFT_THUMB_RIGHT. +i> 0000013C winkey: "_S" binds key 0x53 to controller input LEFT_THUMB_DOWN. +i> 0000013C winkey: "_W" binds key 0x57 to controller input LEFT_THUMB_UP. +i> 0000013C winkey: "F" binds key 0x46 to controller input LEFT_THUMB_PRESSED. +i> 0000013C winkey: "0x26" binds key 0x26 to controller input RIGHT_THUMB_UP. +i> 0000013C winkey: "0x28" binds key 0x28 to controller input RIGHT_THUMB_DOWN. +i> 0000013C winkey: "0x27" binds key 0x27 to controller input RIGHT_THUMB_RIGHT. +i> 0000013C winkey: "0x25" binds key 0x25 to controller input RIGHT_THUMB_LEFT. +i> 0000013C winkey: "K" binds key 0x4B to controller input RIGHT_THUMB_PRESSED. +i> 0000013C winkey: "L" binds key 0x4C to controller input X. +i> 0000013C winkey: "0xDE" binds key 0xDE to controller input B. +i> 0000013C winkey: "0xBA" binds key 0xBA to controller input A. +i> 0000013C winkey: "P" binds key 0x50 to controller input Y. +i> 0000013C winkey: "Q" binds key 0x51 to controller input LEFT_TRIGGER. +i> 0000013C winkey: "I" binds key 0x49 to controller input LEFT_TRIGGER. +i> 0000013C winkey: "E" binds key 0x45 to controller input RIGHT_TRIGGER. +i> 0000013C winkey: "O" binds key 0x4F to controller input RIGHT_TRIGGER. +i> 0000013C winkey: "Z" binds key 0x5A to controller input BACK. +i> 0000013C winkey: "X" binds key 0x58 to controller input START. +i> 0000013C winkey: "1" binds key 0x31 to controller input LEFT_SHOULDER. +i> 0000013C winkey: "3" binds key 0x33 to controller input RIGHT_SHOULDER. +i> 000000E0 SDL Version 2.32.2 initialized. +w> 000000E0 SDL GameControllerDB: file 'gamecontrollerdb.txt' does not exist. +i> 0000013C Setup: Initializing VFS... +i> 0000013C PatchDB: Loaded patches for 0 titles +i> 0000013C Setup: Initializing Kernel... +i> 0000013C ProfileManager: Found 0 Profiles +w> 0000013C BaseHeap::AllocFixed attempting commit on unreserved page +w> 0000013C BaseHeap::AllocFixed attempting commit on unreserved page +i> 0000013C Setup: Starting graphics_system... +i> 0000013C DXGI adapter: NVIDIA GeForce GTX 1070 Ti (vendor 0x1002, device 0x73DF) +i> 0000013C Direct3D 12 device and OS features: +* Max GPU virtual address bits per resource: 40 +* Non-zeroed heap creation: yes +* Pixel-shader-specified stencil reference: no +* Programmable sample positions: tier 0 +* Rasterizer-ordered views: yes +* Resource binding: tier 3 +* Tiled resources: tier 4 +* Unaligned block-compressed textures: yes +i> 0000013C XThread01000010 (1) Stack: 70010000-70030000 +i> 0000013C XThread01000014 (2) Stack: 70050000-70070000 +i> 0000013C Setup: Starting audio_system... +K> 01000010 XThread::Execute thid 1 (handle=01000010, 'GPU Commands (01000010)', native=0000016C, ) +K> 01000014 XThread::Execute thid 2 (handle=01000014, 'GPU Frame limiter (01000014)', native=00000170, ) +i> 0000013C XThread01000018 (3) Stack: 70090000-700B0000 +i> 0000013C XThread0100001C (4) Stack: 700D0000-700F0000 +K> 01000018 XThread::Execute thid 3 (handle=01000018, 'XMA Decoder (01000018)', native=00000198, ) +K> 0100001C XThread::Execute thid 4 (handle=0100001C, 'Audio Worker (0100001C)', native=0000019C, ) +i> 000000E0 Checking for XISO +F> 000000E0 DiscImageDevice::Initialize +i> 000000E0 Checking for XISO +F> 000000E0 DiscImageDevice::Initialize +F> 000000E0 DiscImageDevice::Initialize +i> 000000E0 Loading module GAME:\default.xex +F> 000000E0 DiscImageDevice::ResolvePath(\default.xex) +i> 000000E0 Module \Device\Cdrom0\default.xex: +Module Hash: CCF935D24A74E002 + Module Flags: 00000001 + XEX_MODULE_TITLE +Security Header: + Image Flags: 00000008 + XEX_IMAGE_XGD2_MEDIA_ONLY + Load Address: 82000000 + Image Size: 00920000 + Export Table: 00000000 +Optional Header Count: 15 + XEX_HEADER_RESOURCE_INFO: + 535107D4 828FB900-8291D8CF, 139215b + XEX_HEADER_FILE_FORMAT_INFO: + Info Size: 36 + Encryption Type: Normal + Compression Type: Normal + Window Size: 32768 + Block Size: 61440 + Block Hash: B3 2B D7 D4 EF 96 9A C5 9F D7 77 C6 8A 99 AA 1C BD 87 1C BE 00 90 2E F1 46 3F A3 D7 00 00 00 10 + XEX_HEADER_ENTRY_POINT: 824AB748 + XEX_HEADER_IMAGE_BASE_ADDRESS: 82000000 + XEX_HEADER_IMPORT_LIBRARIES: + xam.xex - 104 imports + Version: 2.0.4552.0 + Min Version: 2.0.4552.0 + xboxkrnl.exe - 294 imports + Version: 2.0.4552.0 + Min Version: 2.0.4552.0 + XEX_HEADER_CHECKSUM_TIMESTAMP: + Checksum : 00902EF1 + Time Stamp: 463FA3D7 - Tue May 8 00:10:31 2007 + XEX_HEADER_ORIGINAL_PE_NAME: default.pe + XEX_HEADER_STATIC_LIBRARIES: + XAPILIB : 2.0.3215.0 + D3D9 : 2.0.3215.1 + D3DX9 : 2.0.3215.0 + XBOXKRNL : 2.0.3215.0 + XAUD : 2.0.3215.0 + LIBCPMT : 2.0.3215.0 + XMP : 2.0.3215.0 + XMEDIA : 2.0.3215.0 + XONLINE : 2.0.3215.0 + XGRAPHC : 2.0.3215.0 + X3DAUD : 2.0.3215.1 + XACT : 2.0.3215.1 + XEX_HEADER_TLS_INFO: + Slot Count: 64 + Raw Data Address: 00000000 + Data Size: 0 + Raw Data Size: 0 + XEX_HEADER_DEFAULT_STACK_SIZE: 524288 + XEX_HEADER_SYSTEM_FLAGS: 00000400 + XEX_SYSTEM_PAL50_INCOMPATIBLE + XEX_HEADER_EXECUTION_INFO: + Media ID: 2D2E2EEB + Title ID: 535107D4 + Savegame ID: 535107D4 + Disc Number / Total: 1 / 1 + XEX_HEADER_GAME_RATINGS: + ESRB: Teen + PEGI: 12+ + PEGI-FI: 11+ + PEGI - PT: 12+ + BBFC: 12+ + CERO: Unrated + USK: Approved for children aged 12 and above + OFLC - AU: Parental Guidance + OFLC - NZ: Parental Guidance + KMRB: Unrated + Brazil: Unrated + FPB: 13+ + XEX_HEADER_LAN_KEY: E0 3C EA 47 3C AE 06 62 98 8F DB 7F 58 50 12 38 + XEX_HEADER_XBOX360_LOGO: + Section Size: 1736 + Logo Size: 1728 +Sections: + 0 RODATA 1 pages 82000000 - 82010000 (65536 bytes) + 1 RODATA 1 pages 82010000 - 82020000 (65536 bytes) + 2 RODATA 1 pages 82020000 - 82030000 (65536 bytes) + 3 RODATA 1 pages 82030000 - 82040000 (65536 bytes) + 4 RODATA 1 pages 82040000 - 82050000 (65536 bytes) + 5 RODATA 1 pages 82050000 - 82060000 (65536 bytes) + 6 RODATA 1 pages 82060000 - 82070000 (65536 bytes) + 7 RODATA 1 pages 82070000 - 82080000 (65536 bytes) + 8 RODATA 1 pages 82080000 - 82090000 (65536 bytes) + 9 RODATA 1 pages 82090000 - 820A0000 (65536 bytes) + 10 RODATA 1 pages 820A0000 - 820B0000 (65536 bytes) + 11 RODATA 1 pages 820B0000 - 820C0000 (65536 bytes) + 12 RODATA 1 pages 820C0000 - 820D0000 (65536 bytes) + 13 RODATA 1 pages 820D0000 - 820E0000 (65536 bytes) + 14 RODATA 1 pages 820E0000 - 820F0000 (65536 bytes) + 15 RODATA 1 pages 820F0000 - 82100000 (65536 bytes) + 16 RODATA 1 pages 82100000 - 82110000 (65536 bytes) + 17 RODATA 1 pages 82110000 - 82120000 (65536 bytes) + 18 RODATA 1 pages 82120000 - 82130000 (65536 bytes) + 19 RODATA 1 pages 82130000 - 82140000 (65536 bytes) + 20 RODATA 1 pages 82140000 - 82150000 (65536 bytes) + 21 CODE 1 pages 82150000 - 82160000 (65536 bytes) + 22 CODE 1 pages 82160000 - 82170000 (65536 bytes) + 23 CODE 1 pages 82170000 - 82180000 (65536 bytes) + 24 CODE 1 pages 82180000 - 82190000 (65536 bytes) + 25 CODE 1 pages 82190000 - 821A0000 (65536 bytes) + 26 CODE 1 pages 821A0000 - 821B0000 (65536 bytes) + 27 CODE 1 pages 821B0000 - 821C0000 (65536 bytes) + 28 CODE 1 pages 821C0000 - 821D0000 (65536 bytes) + 29 CODE 1 pages 821D0000 - 821E0000 (65536 bytes) + 30 CODE 1 pages 821E0000 - 821F0000 (65536 bytes) + 31 CODE 1 pages 821F0000 - 82200000 (65536 bytes) + 32 CODE 1 pages 82200000 - 82210000 (65536 bytes) + 33 CODE 1 pages 82210000 - 82220000 (65536 bytes) + 34 CODE 1 pages 82220000 - 82230000 (65536 bytes) + 35 CODE 1 pages 82230000 - 82240000 (65536 bytes) + 36 CODE 1 pages 82240000 - 82250000 (65536 bytes) + 37 CODE 1 pages 82250000 - 82260000 (65536 bytes) + 38 CODE 1 pages 82260000 - 82270000 (65536 bytes) + 39 CODE 1 pages 82270000 - 82280000 (65536 bytes) + 40 CODE 1 pages 82280000 - 82290000 (65536 bytes) + 41 CODE 1 pages 82290000 - 822A0000 (65536 bytes) + 42 CODE 1 pages 822A0000 - 822B0000 (65536 bytes) + 43 CODE 1 pages 822B0000 - 822C0000 (65536 bytes) + 44 CODE 1 pages 822C0000 - 822D0000 (65536 bytes) + 45 CODE 1 pages 822D0000 - 822E0000 (65536 bytes) + 46 CODE 1 pages 822E0000 - 822F0000 (65536 bytes) + 47 CODE 1 pages 822F0000 - 82300000 (65536 bytes) + 48 CODE 1 pages 82300000 - 82310000 (65536 bytes) + 49 CODE 1 pages 82310000 - 82320000 (65536 bytes) + 50 CODE 1 pages 82320000 - 82330000 (65536 bytes) + 51 CODE 1 pages 82330000 - 82340000 (65536 bytes) + 52 CODE 1 pages 82340000 - 82350000 (65536 bytes) + 53 CODE 1 pages 82350000 - 82360000 (65536 bytes) + 54 CODE 1 pages 82360000 - 82370000 (65536 bytes) + 55 CODE 1 pages 82370000 - 82380000 (65536 bytes) + 56 CODE 1 pages 82380000 - 82390000 (65536 bytes) + 57 CODE 1 pages 82390000 - 823A0000 (65536 bytes) + 58 CODE 1 pages 823A0000 - 823B0000 (65536 bytes) + 59 CODE 1 pages 823B0000 - 823C0000 (65536 bytes) + 60 CODE 1 pages 823C0000 - 823D0000 (65536 bytes) + 61 CODE 1 pages 823D0000 - 823E0000 (65536 bytes) + 62 CODE 1 pages 823E0000 - 823F0000 (65536 bytes) + 63 CODE 1 pages 823F0000 - 82400000 (65536 bytes) + 64 CODE 1 pages 82400000 - 82410000 (65536 bytes) + 65 CODE 1 pages 82410000 - 82420000 (65536 bytes) + 66 CODE 1 pages 82420000 - 82430000 (65536 bytes) + 67 CODE 1 pages 82430000 - 82440000 (65536 bytes) + 68 CODE 1 pages 82440000 - 82450000 (65536 bytes) + 69 CODE 1 pages 82450000 - 82460000 (65536 bytes) + 70 CODE 1 pages 82460000 - 82470000 (65536 bytes) + 71 CODE 1 pages 82470000 - 82480000 (65536 bytes) + 72 CODE 1 pages 82480000 - 82490000 (65536 bytes) + 73 CODE 1 pages 82490000 - 824A0000 (65536 bytes) + 74 CODE 1 pages 824A0000 - 824B0000 (65536 bytes) + 75 CODE 1 pages 824B0000 - 824C0000 (65536 bytes) + 76 CODE 1 pages 824C0000 - 824D0000 (65536 bytes) + 77 CODE 1 pages 824D0000 - 824E0000 (65536 bytes) + 78 CODE 1 pages 824E0000 - 824F0000 (65536 bytes) + 79 CODE 1 pages 824F0000 - 82500000 (65536 bytes) + 80 CODE 1 pages 82500000 - 82510000 (65536 bytes) + 81 CODE 1 pages 82510000 - 82520000 (65536 bytes) + 82 CODE 1 pages 82520000 - 82530000 (65536 bytes) + 83 CODE 1 pages 82530000 - 82540000 (65536 bytes) + 84 CODE 1 pages 82540000 - 82550000 (65536 bytes) + 85 CODE 1 pages 82550000 - 82560000 (65536 bytes) + 86 CODE 1 pages 82560000 - 82570000 (65536 bytes) + 87 CODE 1 pages 82570000 - 82580000 (65536 bytes) + 88 CODE 1 pages 82580000 - 82590000 (65536 bytes) + 89 CODE 1 pages 82590000 - 825A0000 (65536 bytes) + 90 CODE 1 pages 825A0000 - 825B0000 (65536 bytes) + 91 CODE 1 pages 825B0000 - 825C0000 (65536 bytes) + 92 CODE 1 pages 825C0000 - 825D0000 (65536 bytes) + 93 CODE 1 pages 825D0000 - 825E0000 (65536 bytes) + 94 CODE 1 pages 825E0000 - 825F0000 (65536 bytes) + 95 CODE 1 pages 825F0000 - 82600000 (65536 bytes) + 96 CODE 1 pages 82600000 - 82610000 (65536 bytes) + 97 CODE 1 pages 82610000 - 82620000 (65536 bytes) + 98 CODE 1 pages 82620000 - 82630000 (65536 bytes) + 99 CODE 1 pages 82630000 - 82640000 (65536 bytes) + 100 CODE 1 pages 82640000 - 82650000 (65536 bytes) + 101 CODE 1 pages 82650000 - 82660000 (65536 bytes) + 102 CODE 1 pages 82660000 - 82670000 (65536 bytes) + 103 CODE 1 pages 82670000 - 82680000 (65536 bytes) + 104 CODE 1 pages 82680000 - 82690000 (65536 bytes) + 105 CODE 1 pages 82690000 - 826A0000 (65536 bytes) + 106 CODE 1 pages 826A0000 - 826B0000 (65536 bytes) + 107 CODE 1 pages 826B0000 - 826C0000 (65536 bytes) + 108 CODE 1 pages 826C0000 - 826D0000 (65536 bytes) + 109 CODE 1 pages 826D0000 - 826E0000 (65536 bytes) + 110 CODE 1 pages 826E0000 - 826F0000 (65536 bytes) + 111 CODE 1 pages 826F0000 - 82700000 (65536 bytes) + 112 CODE 1 pages 82700000 - 82710000 (65536 bytes) + 113 CODE 1 pages 82710000 - 82720000 (65536 bytes) + 114 CODE 1 pages 82720000 - 82730000 (65536 bytes) + 115 CODE 1 pages 82730000 - 82740000 (65536 bytes) + 116 CODE 1 pages 82740000 - 82750000 (65536 bytes) + 117 CODE 1 pages 82750000 - 82760000 (65536 bytes) + 118 CODE 1 pages 82760000 - 82770000 (65536 bytes) + 119 CODE 1 pages 82770000 - 82780000 (65536 bytes) + 120 CODE 1 pages 82780000 - 82790000 (65536 bytes) + 121 CODE 1 pages 82790000 - 827A0000 (65536 bytes) + 122 CODE 1 pages 827A0000 - 827B0000 (65536 bytes) + 123 CODE 1 pages 827B0000 - 827C0000 (65536 bytes) + 124 CODE 1 pages 827C0000 - 827D0000 (65536 bytes) + 125 CODE 1 pages 827D0000 - 827E0000 (65536 bytes) + 126 CODE 1 pages 827E0000 - 827F0000 (65536 bytes) + 127 CODE 1 pages 827F0000 - 82800000 (65536 bytes) + 128 CODE 1 pages 82800000 - 82810000 (65536 bytes) + 129 CODE 1 pages 82810000 - 82820000 (65536 bytes) + 130 CODE 1 pages 82820000 - 82830000 (65536 bytes) + 131 CODE 1 pages 82830000 - 82840000 (65536 bytes) + 132 CODE 1 pages 82840000 - 82850000 (65536 bytes) + 133 CODE 1 pages 82850000 - 82860000 (65536 bytes) + 134 CODE 1 pages 82860000 - 82870000 (65536 bytes) + 135 RWDATA 1 pages 82870000 - 82880000 (65536 bytes) + 136 RWDATA 1 pages 82880000 - 82890000 (65536 bytes) + 137 RWDATA 1 pages 82890000 - 828A0000 (65536 bytes) + 138 RWDATA 1 pages 828A0000 - 828B0000 (65536 bytes) + 139 RWDATA 1 pages 828B0000 - 828C0000 (65536 bytes) + 140 RWDATA 1 pages 828C0000 - 828D0000 (65536 bytes) + 141 RWDATA 1 pages 828D0000 - 828E0000 (65536 bytes) + 142 RWDATA 1 pages 828E0000 - 828F0000 (65536 bytes) + 143 RWDATA 1 pages 828F0000 - 82900000 (65536 bytes) + 144 RWDATA 1 pages 82900000 - 82910000 (65536 bytes) + 145 RWDATA 1 pages 82910000 - 82920000 (65536 bytes) +Imports: + xam - 52 imports + Version: 0.0.4552.32 + Min Version: 0.0.4552.32 + + Total: 52 + Known: 100% (52 known, 0 unknown) + Implemented: 98% (51 implemented, 1 unimplemented) + + F 82000600 8284DA7C 28C ( 652) XNotifyPositionUI + F 82000604 8284DA8C 2BC ( 700) XamShowSigninUI + F 82000608 8284DA9C 2C1 ( 705) XamShowKeyboardUI + F 8200060C 8284DAAC 2D5 ( 725) !! XamShowGamerCardUIForXUID + F 82000610 8284DABC 2CB ( 715) XamShowDeviceSelectorUI + F 82000614 8284DACC 2D9 ( 729) XamShowDirtyDiscErrorUI + F 82000618 8284DADC 1B3 ( 435) XamTaskShouldExit + F 8200061C 8284DAEC 1B1 ( 433) XamTaskCloseHandle + F 82000620 8284DAFC 1AF ( 431) XamTaskSchedule + F 82000624 8284DB0C 1A4 ( 420) XamLoaderLaunchTitle + F 82000628 8284DB1C 1F7 ( 503) XMsgStartIORequest + F 8200062C 8284DB2C 20E ( 526) XamUserGetName + F 82000630 8284DB3C 210 ( 528) XamUserGetSigninState + F 82000634 8284DB4C 282 ( 642) XamGetSystemVersion + F 82000638 8284DB5C 2F7 ( 759) XamUserCreateStatsEnumerator + F 8200063C 8284DB6C 2EE ( 750) XamUserCreateAchievementEnumerator + F 82000640 8284DB7C 20A ( 522) XamUserGetXUID + F 82000644 8284DB8C 250 ( 592) XamEnumerate + F 82000648 8284DB9C 3CC ( 972) XGetGameRegion + F 8200064C 8284DBAC 190 ( 400) XamInputGetCapabilities + F 82000650 8284DBBC 191 ( 401) XamInputGetState + F 82000654 8284DBCC 192 ( 402) XamInputSetState + F 82000658 8284DBDC 198 ( 408) XamInputGetKeystrokeEx + F 8200065C 8284DBEC 258 ( 600) XamContentCreate + F 82000660 8284DBFC 25B ( 603) XamContentDelete + F 82000664 8284DC0C 25A ( 602) XamContentClose + F 82000668 8284DC1C 260 ( 608) XamContentSetThumbnail + F 8200066C 8284DC2C 262 ( 610) XamContentGetCreator + F 82000670 8284DC3C 25C ( 604) XamContentCreateEnumerator + F 82000674 8284DC4C 265 ( 613) XamContentGetDeviceState + F 82000678 8284DC5C 25E ( 606) XamContentGetDeviceData + F 8200067C 8284DC6C 25F ( 607) XamContentGetDeviceName + F 82000680 8284DC7C 1A0 ( 416) XamEnableInactivityProcessing + F 82000684 8284DC8C 1A1 ( 417) XamResetInactivity + F 82000688 8284DC9C 2DC ( 732) XamShowMessageBoxUIEx + F 8200068C 8284DCAC 3CD ( 973) XGetLanguage + F 82000690 8284DCBC 3CB ( 971) XGetAVPack + F 82000694 8284DCCC 1A9 ( 425) XamLoaderTerminateTitle + F 82000698 8284DCDC 280 ( 640) XamGetExecutionId + F 8200069C 8284E45C 28B ( 651) XNotifyGetNext + F 820006A0 8284E44C 002 ( 2) NetDll_WSACleanup + F 820006A4 8284E43C 001 ( 1) NetDll_WSAStartup + F 820006A8 8284E46C 28A ( 650) XamNotifyCreateListener + F 820006AC 8284E42C 316 ( 790) XamSessionCreateHandle + F 820006B0 8284E41C 317 ( 791) XamSessionRefObjByHandle + F 820006B4 8284E40C 21A ( 538) XamUserWriteProfileSettings + F 820006B8 8284E3FC 219 ( 537) XamUserReadProfileSettings + F 820006BC 8284E3EC 1EA ( 490) XamAlloc + F 820006C0 8284E3DC 1EC ( 492) XamFree + F 820006C4 8284E3CC 3D1 ( 977) XGetVideoMode + F 820006C8 8284E3BC 1F4 ( 500) XMsgInProcessCall + F 820006CC 8284E3AC 1FC ( 508) XMsgStartIORequestEx + + xboxkrnl - 152 imports + Version: 0.0.4552.32 + Min Version: 0.0.4552.32 + + Total: 152 + Known: 100% (152 known, 0 unknown) + Implemented: 95% (145 implemented, 7 unimplemented) + + F 820006D4 8284E1FC 0B4 ( 180) KfReleaseSpinLock + F 820006D8 8284E20C 0B1 ( 177) KfAcquireSpinLock + F 820006DC 8284E21C 1DF ( 479) KiApcNormalRoutineNop + F 820006E0 8284E22C 1B6 ( 438) VdEnableRingBufferRPtrWriteBack + F 820006E4 8284E23C 1C3 ( 451) VdInitializeRingBuffer + F 820006E8 8284E24C 0BE ( 190) MmGetPhysicalAddress + F 820006EC 8284E25C 1D9 ( 473) VdSetSystemCommandBufferGpuIdentifierAddress + F 820006F0 8284E26C 13B ( 315) sprintf + F 820006F4 8284E27C 1B9 ( 441) VdGetCurrentDisplayGamma + V 820006F8 266 ( 614) KeCertMonitorData + F 820006FC 8284E28C 14D ( 333) _vsnprintf + V 82000700 158 ( 344) XboxKrnlVersion + F 82000704 8284E29C 1DC ( 476) VdShutdownEngines + F 82000708 8284E2AC 1CA ( 458) VdQueryVideoMode + F 8200070C 8284E2BC 1BA ( 442) VdGetCurrentDisplayInformation + F 82000710 8284E2CC 1D3 ( 467) VdSetDisplayMode + F 82000714 8284E2DC 1D5 ( 469) VdSetGraphicsInterruptCallback + F 82000718 8284E2EC 1C2 ( 450) VdInitializeEngines + F 8200071C 8284E2FC 1C6 ( 454) VdIsHSIOTrainingSucceeded + F 82000720 8284E30C 1C9 ( 457) VdQueryVideoFlags + F 82000724 8284E31C 1B1 ( 433) VdCallGraphicsNotificationRoutines + V 82000728 1C0 ( 448) VdGpuClockInMHz + F 8200072C 8284E32C 1C5 ( 453) VdInitializeScalerCommandBuffer + F 82000730 8284E33C 269 ( 617) VdRetrainEDRAM + F 82000734 8284E34C 26A ( 618) VdRetrainEDRAMWorker + V 82000738 1C1 ( 449) VdHSIOCalibrationLock + F 8200073C 8284E35C 06B ( 107) KeLockL2 + F 82000740 8284E36C 06C ( 108) KeUnlockL2 + F 82000744 8284E37C 1C7 ( 455) VdPersistDisplay + F 82000748 8284E38C 25B ( 603) VdSwap + F 8200074C 8284E39C 1BD ( 445) VdGetSystemCommandBuffer + V 82000750 1BE ( 446) VdGlobalDevice + F 82000754 8284E1EC 04D ( 77) KeAcquireSpinLockAtRaisedIrql + F 82000758 8284E1DC 089 ( 137) KeReleaseSpinLockFromRaisedIrql + F 8200075C 8284E1CC 1B4 ( 436) VdEnableDisableClockGating + F 82000760 8284E1BC 13F ( 319) RtlTimeFieldsToTime + F 82000764 8284E1AC 136 ( 310) RtlRaiseException + F 82000768 8284E19C 0EE ( 238) NtQueryVirtualMemory + F 8200076C 8284E18C 11B ( 283) RtlCompareMemoryUlong + F 82000770 8284E17C 066 ( 102) KeGetCurrentProcessType + F 82000774 8284E16C 053 ( 83) KeBugCheckEx + F 82000778 8284E15C 126 ( 294) RtlFillMemoryUlong + V 8200077C 1AE ( 430) ExLoadedCommandLine + F 82000780 8284E14C 05A ( 90) KeDelayExecutionThread + F 82000784 8284E13C 143 ( 323) RtlUnicodeToMultiByteN + F 82000788 8284E12C 0E4 ( 228) NtQueryDirectoryFile + F 8200078C 8284E10C 019 ( 25) ExTerminateThread + F 82000790 8284E0FC 09B ( 155) KeSetCurrentStackPointers + F 82000794 8284E0EC 197 ( 407) XexGetProcedureAddress + F 82000798 8284E0DC 03C ( 60) !! IoDismountVolumeByFileHandle + F 8200079C 8284E0CC 0D9 ( 217) NtDeviceIoControlFile + F 820007A0 8284E0BC 028 ( 40) HalReturnToFirmware + F 820007A4 8284E0AC 003 ( 3) DbgPrint + F 820007A8 8284E09C 140 ( 320) RtlTimeToTimeFields + F 820007AC 8284E08C 0FE ( 254) NtWaitForMultipleObjectsEx + F 820007B0 8284E07C 0F3 ( 243) NtReleaseSemaphore + F 820007B4 8284E06C 0D5 ( 213) NtCreateSemaphore + F 820007B8 8284E05C 084 ( 132) KeQuerySystemTime + F 820007BC 8284E04C 0E8 ( 232) NtQueryInformationFile + F 820007C0 8284E03C 0F7 ( 247) NtSetInformationFile + F 820007C4 8284E02C 0FD ( 253) NtWaitForSingleObjectEx + F 820007C8 8284E01C 0CE ( 206) NtClearEvent + F 820007CC 8284E00C 0F5 ( 245) NtResumeThread + V 820007D0 0AD ( 173) KeTimeStampBundle + F 820007D4 8284DFFC 010 ( 16) ExGetXConfigSetting + V 820007D8 059 ( 89) KeDebugMonitorData + F 820007DC 8284DFEC 097 ( 151) KeSetAffinityThread + F 820007E0 8284DFDC 0FC ( 252) NtSuspendThread + F 820007E4 8284DFCC 081 ( 129) KeQueryBasePriorityThread + V 820007E8 01B ( 27) ExThreadObjectType + F 820007EC 8284DFBC 110 ( 272) ObReferenceObjectByHandle + F 820007F0 8284DFAC 099 ( 153) KeSetBasePriorityThread + F 820007F4 8284DF9C 10B ( 267) ObLookupThreadByThreadId + F 820007F8 8284DF8C 10E ( 270) ObOpenObjectByPointer + F 820007FC 8284DF7C 0DA ( 218) NtDuplicateObject + F 82000800 8284DF6C 101 ( 257) NtYieldExecution + F 82000804 8284DF5C 0F6 ( 246) NtSetEvent + F 82000808 8284DF4C 052 ( 82) KeBugCheck + F 8200080C 8284DF3C 0BC ( 188) MmDeleteKernelStack + F 82000810 8284DF2C 0BB ( 187) MmCreateKernelStack + F 82000814 8284DF1C 0D1 ( 209) NtCreateEvent + F 82000818 8284DF0C 135 ( 309) RtlNtStatusToDosError + F 8200081C 8284DEFC 194 ( 404) XexCheckExecutablePrivilege + F 82000820 8284DEEC 05F ( 95) KeEnterCriticalRegion + F 82000824 8284DEDC 07D ( 125) KeLeaveCriticalRegion + F 82000828 8284DECC 0CC ( 204) NtAllocateVirtualMemory + F 8200082C 8284DEBC 259 ( 601) !! StfsCreateDevice + F 82000830 8284DEAC 103 ( 259) ObCreateSymbolicLink + F 82000834 8284DE9C 25A ( 602) !! StfsControlDevice + F 82000838 8284DE8C 0DB ( 219) NtFlushBuffersFile + F 8200083C 8284DE7C 104 ( 260) ObDeleteSymbolicLink + F 82000840 8284DE6C 105 ( 261) ObDereferenceObject + F 82000844 8284DE5C 0DC ( 220) NtFreeVirtualMemory + F 82000848 8284DE4C 0D2 ( 210) NtCreateFile + F 8200084C 8284DE3C 256 ( 598) XeKeysConsolePrivateKeySign + F 82000850 8284DE2C 0F0 ( 240) NtReadFile + F 82000854 8284DE1C 0FF ( 255) NtWriteFile + F 82000858 8284DE0C 192 ( 402) XeCryptSha + F 8200085C 8284DDFC 257 ( 599) !! XeKeysConsoleSignatureVerification + F 82000860 8284DDEC 015 ( 21) ExRegisterTitleTerminateNotification + F 82000864 8284DDDC 09D ( 157) KeSetEvent + F 82000868 8284DDCC 0B0 ( 176) KeWaitForSingleObject + F 8200086C 8284DDBC 08F ( 143) KeResetEvent + V 82000870 193 ( 403) XexExecutableModuleHandle + F 82000874 8284DDAC 12B ( 299) RtlImageXexHeaderField + F 82000878 8284DD9C 1A5 ( 421) !! __C_specific_handler + F 8200087C 8284DD8C 12C ( 300) RtlInitAnsiString + F 82000880 8284DD7C 0DF ( 223) NtOpenFile + F 82000884 8284DD6C 0CF ( 207) NtClose + F 82000888 8284DD5C 0EF ( 239) NtQueryVolumeInformationFile + F 8200088C 8284DD4C 0C4 ( 196) MmQueryAddressProtect + F 82000890 8284DD3C 0BD ( 189) MmFreePhysicalMemory + F 82000894 8284DD2C 0BA ( 186) MmAllocatePhysicalMemoryEx + F 82000898 8284DD1C 12E ( 302) RtlInitializeCriticalSection + F 8200089C 8284DD0C 130 ( 304) RtlLeaveCriticalSection + F 820008A0 8284DCFC 125 ( 293) RtlEnterCriticalSection + F 820008A4 8284DCEC 12F ( 303) RtlInitializeCriticalSectionAndSpinCount + F 820008A8 8284E11C 00D ( 13) ExCreateThread + F 820008AC 8284E47C 085 ( 133) KeRaiseIrqlToDpcLevel + F 820008B0 8284E48C 0B3 ( 179) KfLowerIrql + F 820008B4 8284E49C 088 ( 136) KeReleaseSemaphore + F 820008B8 8284E4AC 1F8 ( 504) XAudioGetVoiceCategoryVolume + F 820008BC 8284E4BC 1F7 ( 503) XAudioGetVoiceCategoryVolumeChangeMask + F 820008C0 8284E4CC 0AF ( 175) KeWaitForMultipleObjects + F 820008C4 8284E4DC 092 ( 146) KeResumeThread + F 820008C8 8284E4EC 074 ( 116) KeInitializeSemaphore + F 820008CC 8284E4FC 226 ( 550) XMAReleaseContext + F 820008D0 8284E50C 224 ( 548) XMACreateContext + F 820008D4 8284E51C 083 ( 131) KeQueryPerformanceFrequency + F 820008D8 8284E52C 141 ( 321) RtlTryEnterCriticalSection + F 820008DC 8284E53C 0AE ( 174) KeTryToAcquireSpinLockAtRaisedIrql + F 820008E0 8284E54C 1F3 ( 499) XAudioRegisterRenderDriverClient + F 820008E4 8284E55C 1F4 ( 500) XAudioUnregisterRenderDriverClient + F 820008E8 8284E56C 1F5 ( 501) XAudioSubmitRenderDriverFrame + F 820008EC 8284E57C 195 ( 405) XexGetModuleHandle + F 820008F0 8284E58C 147 ( 327) !! RtlUnwind + F 820008F4 8284E59C 152 ( 338) KeTlsAlloc + F 820008F8 8284E5AC 154 ( 340) KeTlsGetValue + F 820008FC 8284E5BC 155 ( 341) KeTlsSetValue + F 82000900 8284E5CC 153 ( 339) KeTlsFree + F 82000904 8284E5DC 119 ( 281) !! RtlCaptureContext + F 82000908 8284E5EC 05D ( 93) KeEnableFpuExceptions + F 8200090C 8284E5FC 0C6 ( 198) MmQueryStatistics + F 82000910 8284E60C 0D7 ( 215) NtCreateTimer + F 82000914 8284E61C 0FA ( 250) NtSetTimerEx + F 82000918 8284E62C 0CD ( 205) NtCancelTimer + F 8200091C 8284E63C 0E7 ( 231) NtQueryFullAttributesFile + F 82000920 8284E64C 127 ( 295) RtlFreeAnsiString + F 82000924 8284E65C 142 ( 322) RtlUnicodeStringToAnsiString + F 82000928 8284E66C 12D ( 301) RtlInitUnicodeString + F 8200092C 8284E67C 133 ( 307) RtlMultiByteToUnicodeN + F 82000930 8284E68C 001 ( 1) DbgBreakPoint + +w> 000000E0 GameDatabase: Title doesn't contain XLAST data! Multiplayer functionality might be limited. +i> 000000E0 Title name: PROJECT SYLPHEED +i> 000000E0 +-------------------- ACHIEVEMENTS -------------------- ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| ID | Title | Description | Type | Gamerscore | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 1 | Space Combat Award | Received after your first space battle in the Glasner Training Area. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 2 | Schlos Base Defense Award | Received for stopping the missile attack on Schlos Base. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 3 | Aegis of the People Medal | Received for escorting all 7 refugee ships to safety. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 4 | TCAF Luna Medal | Received for bravely helping the fleet escape during the invasion of the Matisse System. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 5 | TCAF Mars Medal | Received for bravery beyond the call of duty during the escape from the Matisse System. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 6 | Soldier's Charm Amulet | Given to you by Raymond as a token of his trust. | Event | 50 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 7 | White Griffons Patch | Received by the commander and pilots of the White Griffon Squadron when it is formed. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 8 | TCAF Jupiter Medal | Received for bravery during the enemy's attack on the Alberti System. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 9 | Furious Pursuit Badge | Received for continuing attacks on the enemy and shooting down a large number of ships. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 10 | Solo Aerospace Combat Award | Received for descending into Acheron's atmosphere and engaging in combat alone. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 11 | Operation Nebula Blaze Award | Received for completing the extremely hazardous Operation Nebula Blaze. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 12 | Guilty Roses Patch | Received for repelling the Guilty Roses Squadron. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 13 | Super Battleship Slayer Patch | Received for shooting down the second S battleship. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 14 | TCAF Terra Medal | Received for shielding the fleet and seeing that all ships safely fled the Ingres System. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 15 | Hellfires Patch | Received for repelling the enemy Hellfire Squadron. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 16 | Night Ravens Patch | Received for challenging and eradicating the Night Raven Squadron. | Event | 50 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 17 | Solar System Defense Award | Received for great achievements during the campaign to defend the Solar System. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 18 | Special Operations Medal | Received for heroically destroying the Prometheus Driver. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 19 | 1,000 Units Destroyed Medal | Received for shooting down 1,000 enemy fighters and attackers in combat. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 20 | 10,000 Units Destroyed Medal | Received for shooting down 10,000 enemy fighters and attackers in combat. | Event | 70 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 21 | Ship Hunter Award | Received for shooting down 100 enemy warships in combat. | Event | 50 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 22 | Gigaton Club Patch | Received for shooting down enemy vessels with a total weight of one gigaton. | Event | 70 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 23 | Weapon Lord Patch | Received after you collect all usable equipment for the Delta Saber. | Event | 80 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 24 | TCAF Pilot's Commendation | Commemmorates you as one of the greatest pilots in history. | Event | 100 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +i> 000000E0 +-------------------- PROPERTIES -------------------- ++----------+------------------+-------------+-----------+ +| ID | Name | Matchmaking | Data Size | ++----------+------------------+-------------+-----------+ +| 10000006 | Killed Aircrafts | False | 4 | ++----------+------------------+-------------+-----------+ +| 10000008 | Equipments | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000000A | Clear Time | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000000B | Killed Warships | False | 4 | ++----------+------------------+-------------+-----------+ +| 10008001 | Rank | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000800A | | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000800B | | False | 4 | ++----------+------------------+-------------+-----------+ +| 20000005 | Killed Weight | False | 8 | ++----------+------------------+-------------+-----------+ +| 20000007 | Clear Time | False | 8 | ++----------+------------------+-------------+-----------+ +| 20000009 | Earned Points | False | 8 | ++----------+------------------+-------------+-----------+ +| 40008002 | Gamer Name | False | 2 | ++----------+------------------+-------------+-----------+ +i> 000000E0 +-------------------- CONTEXTS -------------------- ++----------+-------------+-------------+---------------+-----------+ +| ID | Name | Matchmaking | Default Value | Max Value | ++----------+-------------+-------------+---------------+-----------+ +| 00000000 | Game Stage | False | 0 | 28 | ++----------+-------------+-------------+---------------+-----------+ +| 00000001 | Game Status | False | 0 | 9 | ++----------+-------------+-------------+---------------+-----------+ +| 00008001 | | False | 0 | 0 | ++----------+-------------+-------------+---------------+-----------+ +| 0000800A | Game Type | True | 0 | 1 | ++----------+-------------+-------------+---------------+-----------+ +| 0000800B | | True | 0 | 0 | ++----------+-------------+-------------+---------------+-----------+ +i> 000000E0 +-------------------- STATS VIEWS -------------------- ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| ID | View Type | Name | Skilled | Arbitrated | Hidden | Team View | Online Only | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000001 | Leaderboard | Time Attack (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000002 | Leaderboard | Score Attack (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000003 | Leaderboard | Extra 1 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000004 | Leaderboard | Extra 1 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000005 | Leaderboard | Extra 2 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000006 | Leaderboard | Extra 2 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000007 | Leaderboard | Extra 3 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000008 | Leaderboard | Extra 3 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000009 | Leaderboard | Extra 4 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 0000000A | Leaderboard | Extra 4 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 0000000C | Leaderboard | Time Attack (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 0000000D | Leaderboard | Score Attack (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| FFFF0000 | Leaderboard | | True | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +i> 000000E0 +-------------------- PRESENCE MODES -------------------- ++---------------+----------------+------------------+ +| Context Value | Contexts Count | Properties Count | ++---------------+----------------+------------------+ +| 0 | 2 | 0 | ++---------------+----------------+------------------+ +i> 000000E0 XThread01000020 (5) Stack: 70110000-70130000 +i> 000000E0 KernelState: Launching module... +i> 000000E0 XThreadF8000008 (6) Stack: 70150000-701D0000 +K> 01000020 XThread::Execute thid 5 (handle=01000020, 'Kernel Dispatch (01000020)', native=000001A8, ) +K> F8000008 XThread::Execute thid 6 (handle=F8000008, 'Main XThread (F8000008)', native=000001AC) +i> 01000010 Loaded 7 shaders from storage +i> 01000010 Loaded 4 pipeline descriptions, 8 shader translations needed +i> 01000010 Translated 7 shaders in 2 ms +i> 01000010 Pipeline cache loaded: 4 created, 0 already exist, 4 total stored +i> 01000010 Pipeline creation took 0 milliseconds +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800000C type=1 initial_state=0 lr=824A9F6C +F> F8000008 NullDevice::ResolvePath() +F> F8000008 NullDevice::ResolvePath() +F> F8000008 NullDevice::ResolvePath() +!> F8000008 undefined extern call to 8284E0DC IoDismountVolumeByFileHandle +F> F8000008 NullDevice::ResolvePath() +i> F8000008 Got xam task args: v1 = 02080002, v2 = 00000000 +i> F8000008 XThreadF8000010 (7) Stack: 701F0000-70270000 +K> F8000010 XThread::Execute thid 7 (handle=F8000010, 'XThread01D0 (F8000010)', native=000001D0) +F> F8000010 NullDevice::ResolvePath() +w> F8000010 Game is attempting to allocate devkit debug memory (base: 00000000, size: 000FF000). Ignoring debug flag and using normal allocation. +!> F8000010 undefined extern call to 8284DEBC StfsCreateDevice +K> F8000010 AUDIT-HLC KeSetEvent guest_ptr=8287094C lr=824A95D0 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000020 type=1 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000024 (8) Stack: 70290000-702B0000 +K> F8000024 XThread::Execute thid 8 (handle=F8000024, 'XThread01D4 (F8000024)', native=000001D4) +K> F8000024 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000020 alertable=0 lr=824AC578 guest_lr=824AFFC4 +F> F8000008 HostPathDevice::ResolvePath() +i> F8000008 XThreadF800002C (9) Stack: 702D0000-702E0000 +K> F800002C XThread::Execute thid 9 (handle=F800002C, 'XThread01D8 (F800002C)', native=000001D8) +F> F800002C HostPathDevice::ResolvePath() +F> F8000008 HostPathDevice::ResolvePath(\d4ea4615\e\46ee8ca) +F> F800002C HostPathDevice::ResolvePath() +F> F8000008 HostPathDevice::ResolvePath(\d4ea4615\e) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000038 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800003C type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000044 (A) Stack: 70300000-70340000 +K> F8000044 XThread::Execute thid 10 (handle=F8000044, 'XThread01DC (F8000044)', native=000001DC) +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800004C type=0 initial_state=0 lr=824A9F6C +!> F800002C BaseHeap::Release failed because address is not a region start +!> F800002C PhysicalHeap::Release failed due to parent heap failure +F> F800002C HostPathDevice::ResolvePath() +F> F800002C HostPathDevice::ResolvePath() +!> F8000044 BaseHeap::Release failed because address is not a region start +!> F8000044 PhysicalHeap::Release failed due to parent heap failure +K> F8000044 AUDIT-HLC NtSetEvent handle=F8000048 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=82452E64 +!> F800002C BaseHeap::Release failed because address is not a region start +!> F800002C PhysicalHeap::Release failed due to parent heap failure +K> F800002C AUDIT-HLC NtWaitForSingleObjectEx handle=F8000028 alertable=0 lr=824AC578 guest_lr=824AFFC4 +!> F8000008 BaseHeap::Release failed because address is not a region start +!> F8000008 PhysicalHeap::Release failed due to parent heap failure +!> F8000008 BaseHeap::Release failed because address is not a region start +!> F8000008 PhysicalHeap::Release failed due to parent heap failure +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\8\3421153) +F> F8000008 DiscImageDevice::ResolvePath(\dat) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\355f2f8) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000034 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000034 alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000048 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000048 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800004C type=0 initial_state=0 lr=824A9F6C +i> F8000044 XThreadF8000054 (B) Stack: 70360000-70370000 +K> F8000044 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000048 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000054 XThread::Execute thid 11 (handle=F8000054, 'XThread01E0 (F8000054)', native=000001E0) +K> F8000054 AUDIT-HLC NtSetEvent handle=F8000048 lr=824AA304 +K> F8000044 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000048 result=00000000 lr=824AC578 guest_lr=8245148C +!> F8000044 BaseHeap::Release failed because address is not a region start +!> F8000044 PhysicalHeap::Release failed due to parent heap failure +K> F8000044 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000034 result=00000000 lr=824AC578 guest_lr=82452E64 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000034 type=1 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000048 (C) Stack: 70390000-703A0000 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000048 XThread::Execute thid 12 (handle=F8000048, 'XThread01E4 (F8000048)', native=000001E4) +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +i> F8000008 Hardware scaler: width ratio 1:1, height ratio 1:1, final aspect ratio 16:9 +i> 01000010 Selecting rep movs vastcpy. +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800005C type=1 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000060 type=1 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000064 (D) Stack: 703C0000-70440000 +K> F8000064 XThread::Execute thid 13 (handle=F8000064, 'XThread01E8 (F8000064)', native=000001E8) +F> F8000008 HostPathDevice::ResolvePath(\aab216c3\a\2c8c185) +F> F8000008 HostPathDevice::ResolvePath(\aab216c3\a) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800006C type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800006C alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000074 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000074 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000044 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000074 alertable=0 lr=824AC578 guest_lr=8245148C +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000054 AUDIT-HLC NtSetEvent handle=F8000074 lr=824AA304 +K> F8000044 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000074 result=00000000 lr=824AC578 guest_lr=8245148C +!> F8000044 BaseHeap::Release failed because address is not a region start +!> F8000044 PhysicalHeap::Release failed due to parent heap failure +K> F8000044 AUDIT-HLC NtSetEvent handle=F8000070 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800006C result=00000000 lr=824AC578 guest_lr=82452E64 +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\73a5c0a) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800006C type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800006C alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000074 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000074 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000074 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000054 AUDIT-HLC NtSetEvent handle=F8000074 lr=824AA304 +K> F8000044 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000074 result=00000000 lr=824AC578 guest_lr=8245148C +K> F8000044 AUDIT-HLC NtSetEvent handle=F8000070 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800006C result=00000000 lr=824AC578 guest_lr=82452E64 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +i> F8000008 XThreadF800006C (E) Stack: 70460000-704E0000 +i> F8000008 XThreadF8000070 (F) Stack: 70500000-70580000 +K> F800006C XThread::Execute thid 14 (handle=F800006C, 'XThread01EC (F800006C)', native=000001EC) +K> F8000070 XThread::Execute thid 15 (handle=F8000070, 'XThread01F0 (F8000070)', native=000001F0) +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +i> F8000008 AudioSystem::RegisterClient: driver created for index=0, driver=0x7286d7020040 +i> F8000008 AudioSystem::RegisterClient: client 0 registered successfully +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000084 type=0 initial_state=0 lr=824A9F6C +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\39a9dcc) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000084 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +!> F8000044 BaseHeap::Release failed because address is not a region start +!> F8000044 PhysicalHeap::Release failed due to parent heap failure +K> F8000044 AUDIT-HLC NtSetEvent handle=F800008C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000084 result=00000000 lr=824AC578 guest_lr=8245FA10 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000084 type=0 initial_state=0 lr=824A9F6C +F> F8000008 DiscImageDevice::ResolvePath(\dat) +K> F8000008 AUDIT-HLC NtSetEvent handle=F800008C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000084 alertable=0 lr=824AC578 guest_lr=82460150 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000084 result=00000000 lr=824AC578 guest_lr=82460150 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000084 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000084 alertable=0 lr=824AC578 guest_lr=82179148 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtSetEvent handle=F800008C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000084 result=00000000 lr=824AC578 guest_lr=82179148 +i> F8000008 XThreadF8000084 (10) Stack: 705A0000-705B0000 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800008C alertable=0 lr=824AC578 guest_lr=82173BD4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 XThread::Execute thid 16 (handle=F8000084, 'XThread0204 (F8000084)', native=00000204) +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC NtSetEvent handle=F800008C lr=824AA304 +K> F8000064 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000034 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800008C result=00000000 lr=824AC578 guest_lr=82173BD4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000034 lr=824AA304 +K> F8000064 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000034 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000090 (11) Stack: 705D0000-70650000 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000090 alertable=0 lr=824AC578 guest_lr=822F1B50 +K> F8000090 XThread::Execute thid 17 (handle=F8000090, 'XThread0208 (F8000090)', native=00000208) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000090 AUDIT-HLC NtCreateEvent handle=F8000094 type=1 initial_state=1 lr=824A9F6C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000090 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +F> F8000090 HostPathDevice::ResolvePath(\aab216c3\5\ee70e0a) +F> F8000090 HostPathDevice::ResolvePath(\aab216c3\5) +K> F8000090 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000098 alertable=0 lr=824AC578 guest_lr=821CBAE0 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A4 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A4 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A4 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000054 AUDIT-HLC NtSetEvent handle=F80000A4 lr=824AA304 +K> F8000044 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000A4 result=00000000 lr=824AC578 guest_lr=8245148C +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000A0 lr=824AA304 +K> F8000090 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000098 result=00000000 lr=824AC578 guest_lr=821CBAE0 +i> F8000090 XThreadF8000098 (12) Stack: 70670000-70680000 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000098 XThread::Execute thid 18 (handle=F8000098, 'XThread020C (F8000098)', native=0000020C) +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +i> F8000098 XThreadF80000A0 (13) Stack: 706A0000-706D0000 +i> F8000098 XThreadF80000A4 (14) Stack: 706F0000-70720000 +K> F80000A0 XThread::Execute thid 19 (handle=F80000A0, 'XThread0210 (F80000A0)', native=00000210) +K> F80000A4 XThread::Execute thid 20 (handle=F80000A4, 'XThread0214 (F80000A4)', native=00000214) +K> F80000A4 AUDIT-HLC NtWaitForSingleObjectEx handle=F800009C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F800009C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000090 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +F> F8000090 HostPathDevice::ResolvePath(\87719002\c\dba806e) +F> F8000090 HostPathDevice::ResolvePath(\87719002\c) +K> F8000090 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +F> F8000090 HostPathDevice::ResolvePath(\87719002\c\ec0a96e) +F> F8000090 HostPathDevice::ResolvePath(\87719002\c) +F> F8000098 DiscImageDevice::ResolvePath(\hidden\Resource3D) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000C4 type=1 initial_state=0 lr=824A9F6C +K> F8000090 AUDIT-HLC NtCreateEvent handle=F80000C8 type=0 initial_state=0 lr=824A9F6C +F> F8000090 HostPathDevice::ResolvePath(\87719002\a\60fcb85) +F> F8000090 HostPathDevice::ResolvePath(\87719002\a) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000090 AUDIT-HLC NtCreateEvent handle=F80000D4 type=0 initial_state=0 lr=824A9F6C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C4 alertable=0 lr=824AC578 guest_lr=822DFCC8 +F> F8000090 HostPathDevice::ResolvePath(\87719002\2\85d8849) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +F> F8000090 HostPathDevice::ResolvePath(\87719002\2) +K> F8000090 AUDIT-HLC NtCreateEvent handle=F80000E4 type=0 initial_state=0 lr=824A9F6C +F> F8000090 HostPathDevice::ResolvePath(\87719002\a\715f485) +F> F8000090 HostPathDevice::ResolvePath(\87719002\a) +K> F8000090 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +F> F8000090 HostPathDevice::ResolvePath(\87719002\c\f2a8ccd) +F> F8000090 HostPathDevice::ResolvePath(\87719002\c) +K> F8000090 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +F> F8000090 HostPathDevice::ResolvePath(\87719002\0\1a2db9c) +F> F8000090 HostPathDevice::ResolvePath(\87719002\0) +K> F8000090 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C515C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +!> F8000044 BaseHeap::Release failed because address is not a region start +!> F8000044 PhysicalHeap::Release failed due to parent heap failure +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000B0 lr=824AA304 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +!> F8000044 BaseHeap::Release failed because address is not a region start +!> F8000044 PhysicalHeap::Release failed due to parent heap failure +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000BC lr=824AA304 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000D0 lr=824AA304 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C4 result=00000000 lr=824AC578 guest_lr=822DFCC8 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C4 alertable=0 lr=824AC578 guest_lr=822DFE24 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +!> F8000044 BaseHeap::Release failed because address is not a region start +!> F8000044 PhysicalHeap::Release failed due to parent heap failure +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000E0 lr=824AA304 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000EC lr=824AA304 +K> F8000090 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C515C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000F8 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000090 result=00000000 lr=824AC578 guest_lr=822F1B50 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +!> F8000044 BaseHeap::Release failed because address is not a region start +!> F8000044 PhysicalHeap::Release failed due to parent heap failure +K> F8000044 AUDIT-HLC NtSetEvent handle=F8000104 lr=824AA304 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000AC lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C4 result=00000000 lr=824AC578 guest_lr=822DFE24 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C4 alertable=0 lr=824AC578 guest_lr=822DFED0 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF80000B8 (15) Stack: 705D0000-705E0000 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000BC alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F80000B8 XThread::Execute thid 21 (handle=F80000B8, 'XThread0218 (F80000B8)', native=00000218) +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000BC result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000CC type=1 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000AC lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C4 result=00000000 lr=824AC578 guest_lr=822DFED0 +i> F8000008 XThreadF80000AC (16) Stack: 70600000-70610000 +K> F80000AC XThread::Execute thid 22 (handle=F80000AC, 'XThread021C (F80000AC)', native=0000021C) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B0 alertable=0 lr=824AC578 guest_lr=82172BC8 +K> F8000064 AUDIT-HLC NtSetEvent handle=F80000B0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B0 result=00000000 lr=824AC578 guest_lr=82172BC8 +K> F8000064 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000034 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F80000AC AUDIT-HLC NtWaitForSingleObjectEx handle=F80000CC alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +F> F8000098 DiscImageDevice::ResolvePath(\hidden\Resource3D) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000C4 type=1 initial_state=0 lr=824A9F6C +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C4 alertable=0 lr=824AC578 guest_lr=822DFCC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000D0 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C4 result=00000000 lr=824AC578 guest_lr=822DFCC8 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C4 alertable=0 lr=824AC578 guest_lr=822DFE24 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000E8 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF80000E4 (17) Stack: 70630000-70640000 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000E8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000E8 type=0 initial_state=0 lr=824A9F6C +K> F80000E4 XThread::Execute thid 23 (handle=F80000E4, 'XThread0220 (F80000E4)', native=00000220) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000E8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF80000F8 (18) Stack: 70740000-707C0000 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000104 (19) Stack: 707E0000-70860000 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F80000F8 XThread::Execute thid 24 (handle=F80000F8, 'XThread0224 (F80000F8)', native=00000224) +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000104 XThread::Execute thid 25 (handle=F8000104, 'XThread0228 (F8000104)', native=00000228) +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000034 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000064 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000034 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000D0 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C4 result=00000000 lr=824AC578 guest_lr=822DFE24 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C4 alertable=0 lr=824AC578 guest_lr=822DFED0 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A8 alertable=0 lr=824AC578 guest_lr=821CC19C +K> F8000064 AUDIT-HLC NtSetEvent handle=F80000A8 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000A8 result=00000000 lr=824AC578 guest_lr=821CC19C +K> F8000064 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000034 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000D0 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C4 result=00000000 lr=824AC578 guest_lr=822DFED0 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +F> F8000098 DiscImageDevice::ResolvePath(\hidden\Resource3D) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000C0 type=1 initial_state=0 lr=824A9F6C +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=822DFCC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000C4 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=822DFCC8 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=822DFE24 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000C4 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=822DFE24 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=822DFED0 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000C4 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=822DFED0 +F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\f\ca5c62e) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\d\14ba3f8) +F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\d) +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A8 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +!> F8000044 BaseHeap::Release failed because address is not a region start +!> F8000044 PhysicalHeap::Release failed due to parent heap failure +!> F8000044 BaseHeap::Release failed because address is not a region start +!> F8000044 PhysicalHeap::Release failed due to parent heap failure +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000C4 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000A8 result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\8\14c242d) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\5\6324af0) +F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\5) +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A8 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000C4 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000A8 result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\d\70a9531) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\a\c9606f9) +F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\a) +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A8 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000C4 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000A8 result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\7\9f2d535) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\4\efaecd1) +F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\4) +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A8 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000C4 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000A8 result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\7\0c3bba2) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\4\59fbfe8) +F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\4) +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A8 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000C4 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000A8 result=00000000 lr=824AC578 guest_lr=8245FA10 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000034 lr=824AA304 +K> F8000064 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000034 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000094 alertable=0 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000094 result=00000000 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000094 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B4 alertable=0 lr=824AC578 guest_lr=821CC19C +K> F8000064 AUDIT-HLC NtSetEvent handle=F80000B4 lr=824AA304 +K> F8000064 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000034 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B4 result=00000000 lr=824AC578 guest_lr=821CC19C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000034 lr=824AA304 +K> F8000064 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000034 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000094 alertable=0 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000094 result=00000000 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000094 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF80000D0 (1A) Stack: 70880000-70900000 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F80000D0 XThread::Execute thid 26 (handle=F80000D0, 'XThread022C (F80000D0)', native=0000022C) +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F80000D0 AUDIT-HLC NtCreateEvent handle=F800010C type=1 initial_state=1 lr=824A9F6C +K> F80000D0 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +F> F80000D0 HostPathDevice::ResolvePath(\aab216c3\5\c10eae6) +F> F80000D0 HostPathDevice::ResolvePath(\aab216c3\5) +K> F80000D0 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000110 alertable=0 lr=824AC578 guest_lr=821CBAE0 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800011C type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800011C type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtWaitForSingleObjectEx handle=F800011C alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000054 AUDIT-HLC NtSetEvent handle=F800011C lr=824AA304 +K> F8000044 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800011C result=00000000 lr=824AC578 guest_lr=8245148C +K> F8000044 AUDIT-HLC NtSetEvent handle=F8000118 lr=824AA304 +K> F80000D0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000110 result=00000000 lr=824AC578 guest_lr=821CBAE0 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000084 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +F> F8000084 DiscImageDevice::ResolvePath(\dat) +K> F8000084 AUDIT-HLC NtSetEvent handle=F800011C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000114 alertable=0 lr=824AC578 guest_lr=82460150 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000114 result=00000000 lr=824AC578 guest_lr=82460150 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C4 alertable=0 lr=824AC578 guest_lr=82172BC8 +K> F8000064 AUDIT-HLC NtSetEvent handle=F80000C4 lr=824AA304 +K> F8000064 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000034 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C4 result=00000000 lr=824AC578 guest_lr=82172BC8 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +F> F8000008 DiscImageDevice::ResolvePath(\dat\movie) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800011C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000120 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000124 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000128 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800012C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000130 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000134 type=0 initial_state=1 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +F> F8000008 DiscImageDevice::ResolvePath(\dat\movie) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800013C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000140 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000144 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000148 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800014C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000150 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000154 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000158 type=0 initial_state=1 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +i> F8000008 XThreadF800015C (1B) Stack: 70880000-70890000 +i> F8000008 XThreadF8000160 (1C) Stack: 708B0000-708C0000 +i> F8000008 XThreadF8000164 (1D) Stack: 708E0000-708F0000 +i> F8000008 XThreadF8000168 (1E) Stack: 70910000-70920000 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000034 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000064 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000034 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25284 lr=82507ABC +K> F8000064 AUDIT-HLC silph_ctx_dump ctx_base=BCE251C0 (event BCE25284 at +C4) +K> F8000064 AUDIT-HLC DUMP BCE251C0: 8200A1E8 BCE251C0 BCE251C0 00000001 +K> F8000064 AUDIT-HLC DUMP BCE251D0: 01000000 00000000 3F7FCCCC 3F802D83 +K> F8000064 AUDIT-HLC DUMP BCE251E0: 00000000 00000001 30057018 BCE25640 +K> F8000064 AUDIT-HLC DUMP BCE251F0: BE568F00 00000000 00000000 00000000 +K> F8000064 AUDIT-HLC DUMP BCE25200: 00000000 00000000 00000000 00000000 +K> F8000064 AUDIT-HLC DUMP BCE25210: 00000000 01000000 00000000 BCE2521C +K> F8000064 AUDIT-HLC DUMP BCE25220: BCE2521C 01000000 00000000 BCE2522C +K> F8000064 AUDIT-HLC DUMP BCE25230: BCE2522C 01000000 00000000 BCE2523C +K> F8000064 AUDIT-HLC DUMP BCE25240: BCE2523C 01000000 00000000 BCE2524C +K> F8000064 AUDIT-HLC DUMP BCE25250: BCE2524C 00000000 00000001 58454E00 +K> F8000064 AUDIT-HLC DUMP BCE25260: F800016C 00000000 00000001 58454E00 +K> F8000064 AUDIT-HLC DUMP BCE25270: F8000170 00000000 00000001 58454E00 +K> F8000064 AUDIT-HLC DUMP BCE25280: F8000174 00000000 00000001 58454E00 +K> F8000064 AUDIT-HLC DUMP BCE25290: F8000178 00000001 00000001 00000005 +K> F8000064 AUDIT-HLC DUMP BCE252A0: 00000000 00000000 00000500 000002D0 +K> F8000064 AUDIT-HLC DUMP BCE252B0: 00000001 00000000 00000000 00000000 +K> F8000064 AUDIT-HLC DUMP BCE252C0: 00000000 00000000 F800015C F8000160 +K> F8000064 AUDIT-HLC DUMP BCE252D0: F8000164 F8000168 3F800000 00000000 +K> F8000064 AUDIT-HLC DUMP BCE252E0: 00000000 00000000 C9D4E2F1 00458000 +K> F8000064 AUDIT-HLC DUMP BCE252F0: 00053C96 E1B10217 00273000 0000D852 +K> F8000064 AUDIT-HLC DUMP BCE25300: EF97D70C 00533800 0000C068 FC2B1076 +K> F8000064 AUDIT-HLC DUMP BCE25310: 00228800 00000096 00000000 00000000 +K> F8000064 AUDIT-HLC DUMP BCE25320: 00000000 00000000 00000000 00000000 +K> F8000064 AUDIT-HLC DUMP BCE25330: 00000000 00000000 00000000 00000000 +K> F8000064 AUDIT-HLC DUMP BCE25340: 07C65ADA 001EE000 0003A313 0A16C32D +K> F8000064 AUDIT-HLC DUMP BCE25350: 004E6800 00000096 15B20D91 004AC000 +K> F8000064 AUDIT-HLC DUMP BCE25360: 0003A313 28824F7D 002A0000 0001A7B3 +K> F8000064 AUDIT-HLC DUMP BCE25370: 340AB384 00281000 0001EED7 366E0234 +K> F8000064 AUDIT-HLC DUMP BCE25380: 00562800 0001B751 389766D3 00255800 +K> F8000064 AUDIT-HLC DUMP BCE25390: 0000D21B 399D8FD3 00263000 0000FAA7 +K> F8000064 AUDIT-HLC DUMP BCE253A0: 42589090 00540000 000220D3 46844E1D +K> F8000064 AUDIT-HLC DUMP BCE253B0: 00516000 0000D8F5 478A771D 00524000 +K> F8000064 AUDIT-HLC DUMP BCE253C0: 0000F3F8 4EF1DADB 0017E000 000064BD +K> F8000064 AUDIT-HLC DUMP BCE253D0: 53D66292 00000000 0017D9C4 5C3FBE10 +K> F8000064 AUDIT-HLC DUMP BCE253E0: 00438800 0000778E 6110543D 002BA800 +K> F8000064 AUDIT-HLC DUMP BCE253F0: 0017D9C4 8E32D0DC 00251800 00003E12 +K> F8000064 AUDIT-HLC DUMP BCE25400: 99D964C8 00184800 00017C57 9CE5067F +K> F8000064 AUDIT-HLC DUMP BCE25410: 00511000 00004AE7 A7B85146 00440000 +K> F8000064 AUDIT-HLC DUMP BCE25420: 0001790C B408C4D3 00229000 000282BA +K> F8000064 AUDIT-HLC DUMP BCE25430: BBF5F673 0019C800 0005116C C2E7AB28 +K> F8000064 AUDIT-HLC DUMP BCE25440: 004E7000 00029B67 C9D4E2F1 00458000 +K> F8000064 AUDIT-HLC DUMP BCE25450: 00053C96 E1B10217 00273000 0000D852 +K> F8000064 AUDIT-HLC DUMP BCE25460: EF97D70C 00533800 0000C068 FC2B1076 +K> F8000064 AUDIT-HLC DUMP BCE25470: 00228800 00000096 00000000 00000000 +K> F8000064 AUDIT-HLC DUMP BCE25480: 00000000 00000000 00000000 00000000 +K> F8000064 AUDIT-HLC DUMP BCE25490: 00000000 00000000 00000000 00000000 +K> F8000064 AUDIT-HLC DUMP BCE254A0: 00000000 00000000 00000000 00000000 +K> F8000064 AUDIT-HLC DUMP BCE254B0: 00000000 00000000 00000000 00000000 +K> F8000064 AUDIT-HLC silph_ctx event-slots: +K> F8000064 AUDIT-HLC slot[0] off=+54 addr=BCE25214 hdr=01000000 state=00000000 +K> F8000064 AUDIT-HLC slot[1] off=+64 addr=BCE25224 hdr=01000000 state=00000000 +K> F8000064 AUDIT-HLC slot[2] off=+74 addr=BCE25234 hdr=01000000 state=00000000 +K> F8000064 AUDIT-HLC slot[3] off=+84 addr=BCE25244 hdr=01000000 state=00000000 +K> F8000064 AUDIT-HLC slot[4] off=+94 addr=BCE25254 hdr=00000000 state=00000001 +K> F8000064 AUDIT-HLC slot[5] off=+A4 addr=BCE25264 hdr=00000000 state=00000001 +K> F8000064 AUDIT-HLC slot[6] off=+B4 addr=BCE25274 hdr=00000000 state=00000001 +K> F8000064 AUDIT-HLC slot[7] off=+C4 addr=BCE25284 hdr=00000000 state=00000001 +K> F800015C XThread::Execute thid 27 (handle=F800015C, 'XThread0230 (F800015C)', native=00000230) +K> F8000160 XThread::Execute thid 28 (handle=F8000160, 'XThread0234 (F8000160)', native=00000234) +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000164 XThread::Execute thid 29 (handle=F8000164, 'XThread0238 (F8000164)', native=00000238) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 diff --git a/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.log.run2 b/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.log.run2 new file mode 100644 index 0000000..27ce8d9 --- /dev/null +++ b/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.log.run2 @@ -0,0 +1,36380 @@ +i> 000000D4 Build: canary_experimental@99fd19d02 on Jun 5 2026 +i> 000000D4 Storage root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug +i> 000000D4 ----------- CONFIG DUMP ----------- + +[APU] +apu = "any" +apu_max_queued_frames = 8 +enable_xmp = true +ffmpeg_verbose = false +mute = false +use_dedicated_xma_thread = true +xma_decoder = "new" + +[Auditing] +audit_handle_lifecycle = false +audit_jit_prolog_pc = 0 + +[CPU] +break_condition_gpr = -1 +break_condition_op = "eq" +break_condition_truncate = true +break_condition_value = 0 +break_on_debugbreak = true +break_on_instruction = 0 +break_on_start = false +break_on_unimplemented_instructions = true +clock_no_scaling = false +clock_source_raw = false +cpu = "any" +debug_symbol_loader = false +debugprint_trap_log = false +disable_context_promotion = false +disable_instruction_infocache = false +disable_prefetch_and_cachecontrol = true +disassemble_functions = false +dump_translated_hir_functions = false +elide_e0_check = false +emit_inline_mmio_checks = false +emit_mmio_aware_stores_for_recorded_exception_addresses = true +emit_source_annotations = false +enable_early_precompilation = false +full_optimization_even_with_debug = false +ignore_trap_instructions = true +ignore_undefined_externs = true +inline_loadclock = false +inline_mmio_access = true +load_module_map = "" +no_reserved_ops = false +no_round_to_single = false +permit_float_constant_evaluation = false +pvr = 7407360 +record_mmio_access_exceptions = true +store_all_context_values = false +trace_function_coverage = false +trace_function_data = false +trace_function_data_path = "" +trace_function_references = false +trace_functions = false +use_fast_dot_product = false +validate_hir = false +writable_code_segments = false + +[Config] +defaults_date = 2026040912 + +[Content] +license_mask = 0 + +[D3D12] +d3d12_adapter = -1 +d3d12_allow_variable_refresh_rate_and_tearing = true +d3d12_bindless = true +d3d12_break_on_error = false +d3d12_break_on_warning = false +d3d12_debug = false +d3d12_dxbc_disasm = false +d3d12_dxbc_disasm_dxilconv = false +d3d12_pipeline_creation_threads = -1 +d3d12_queue_priority = 1 +d3d12_submit_on_primary_buffer_end = true +d3d12_tessellation_wireframe = false + +[Display] +fullscreen = false +host_present_from_non_ui_thread = true +postprocess_antialiasing = "" +postprocess_dither = true +postprocess_ffx_cas_additional_sharpness = 0 +postprocess_ffx_fsr_max_upsampling_passes = 4 +postprocess_ffx_fsr_sharpness_reduction = 0.20000000298023224 +postprocess_scaling_and_sharpening = "" +present_letterbox = true +present_render_pass_clear = true +present_safe_area_x = 100 +present_safe_area_y = 100 + +[GPU] +anisotropic_override = -1 +async_shader_compilation = true +clear_memory_page_state = false +depth_float24_convert_in_pixel_shader = false +depth_float24_round = false +depth_transfer_not_equal_test = true +disassemble_pm4 = false +draw_resolution_scale_x = 1 +draw_resolution_scale_y = 1 +draw_resolution_scaled_texture_offsets = true +dump_shaders = "" +dxbc_source_map = false +dxbc_switch = true +execute_unclipped_draw_vs_on_cpu = true +execute_unclipped_draw_vs_on_cpu_for_psi_render_backend = true +execute_unclipped_draw_vs_on_cpu_with_scissor = false +force_convert_line_loops_to_strips = false +force_convert_quad_lists_to_triangle_lists = false +force_convert_triangle_fans_to_lists = false +framerate_limit = 0 +gamma_render_target_as_unorm16 = true +gpu = "any" +gpu_3d_to_2d_texture = true +gpu_allow_invalid_fetch_constants = true +gpu_allow_invalid_upload_range = false +half_pixel_offset = true +ignore_32bit_vertex_index_support = false +log_guest_driven_gpu_register_written_values = false +log_ringbuffer_kickoff_initiator_bts = false +mrt_edram_used_range_clamp_to_min = true +native_2x_msaa = true +native_stencil_value_output = true +native_stencil_value_output_d3d12_intel = false +no_discard_stencil_in_transfer_pipelines = false +non_seamless_cube_map = true +occlusion_query = "fast" +occlusion_query_fake_lower_threshold = 80 +occlusion_query_fake_upper_threshold = 100 +occlusion_query_querybatch_range = 0 +occlusion_query_saturation = 1 +primitive_processor_cache_min_indices = 4096 +readback_memexport = false +readback_resolve = "none" +render_target_path_d3d12 = "" +render_target_path_vulkan = "" +resolve_resolution_scale_fill_half_pixel_offset = true +snorm16_render_target_full_range = true +store_shaders = true +target_trace_file = "" +texture_cache_memory_limit_hard = 768 +texture_cache_memory_limit_render_to_texture = 24 +texture_cache_memory_limit_soft = 384 +texture_cache_memory_limit_soft_lifetime = 30 +tiled_shared_memory = true +trace_dump_path = "" +trace_gpu_prefix = "scratch/gpu/" +trace_gpu_stream = false +use_fuzzy_alpha_epsilon = false +vsync = true + +[General] +allow_game_relative_writes = false +allow_plugins = false +apply_patches = true +controller_hotkeys = false +debug = false +disable_doubleclick_fullscreen = false +discord = true +launch_module = "" +notification_sound_path = "" +priority_class = 0 +recent_titles_entry_amount = 10 +time_scalar = 1 + +[HACKS] +ac6_ground_fix = false + +[HID] +guide_button = true +hid = "any" +keyboard_mode = 0 +keyboard_user_index = 0 +left_stick_deadzone_percentage = 0 +right_stick_deadzone_percentage = 0 +vibration = true + +[HID.WinKey] +keybind_a = "0xBA" +keybind_b = "0xDE" +keybind_back = "Z" +keybind_dpad_down = "^S" +keybind_dpad_left = "^A" +keybind_dpad_right = "^D" +keybind_dpad_up = "^W" +keybind_guide = "0x08" +keybind_left_shoulder = "1" +keybind_left_thumb = "F" +keybind_left_thumb_down = "_S" +keybind_left_thumb_left = "_A" +keybind_left_thumb_right = "_D" +keybind_left_thumb_up = "_W" +keybind_left_trigger = "Q I" +keybind_right_shoulder = "3" +keybind_right_thumb = "K" +keybind_right_thumb_down = "0x28" +keybind_right_thumb_left = "0x25" +keybind_right_thumb_right = "0x27" +keybind_right_thumb_up = "0x26" +keybind_right_trigger = "E O" +keybind_start = "X" +keybind_x = "L" +keybind_y = "P" + +[Kernel] +allow_avatar_initialization = false +allow_incompatible_title_update = true +apply_title_update = true +cl = "" +console_type = 0 +default_achievements_backend = "GPD" +ignore_thread_affinities = true +ignore_thread_priorities = false +kernel_build_version = 1888 +kernel_cert_monitor = false +kernel_debug_monitor = false +kernel_display_gamma_power = 2.22222233 +kernel_display_gamma_type = 2 +kernel_pix = false +staging_mode = false + +[Logging] +enable_console = false +flush_log = true +log_file = "" +log_high_frequency_kernel_calls = false +log_level = 2 +log_mask = 0 +log_string_format_kernel_calls = false +log_to_debugprint = false +log_to_stdout = true + +[Memory] +ignore_offset_for_ranged_allocations = false +protect_on_release = false +protect_zero = true +scribble_heap = false +scribble_heap_value = 0 +writable_executable_memory = true + +[Profiles] +logged_profile_slot_0_xuid = "" +logged_profile_slot_1_xuid = "" +logged_profile_slot_2_xuid = "" +logged_profile_slot_3_xuid = "" + +[SDL] +mappings_file = "gamecontrollerdb.txt" + +[Storage] +cache_root = "" +content_root = "" +force_mount_devkit = false +mount_cache = true +mount_memory_unit = false +mount_scratch = false +storage_root = "" + +[UI] +custom_font_path = "" +font_size = 14 +headless = false +imgui_debug = false +profiler_dpi_scaling = false +show_achievement_notification = false +show_profiler = false +storage_selection_dialog = false +window_size_x = 1280 +window_size_y = 720 + +[Video] +avpack = 8 +custom_internal_display_resolution_x = 0 +custom_internal_display_resolution_y = 0 +enable_3d_mode = false +interlaced = false + +[Vulkan] +vulkan_allow_present_mode_fifo_relaxed = true +vulkan_allow_present_mode_immediate = true +vulkan_allow_present_mode_mailbox = true +vulkan_device = -1 +vulkan_log_debug_messages = true +vulkan_pipeline_creation_threads = -1 +vulkan_semaphore_reuse_workaround = false +vulkan_sparse_shared_memory = true +vulkan_validation = false + +[Win32] +win32_high_resolution_timer = true +win32_mmcss = true + +[x64] +align_all_basic_blocks = 0 +delay_via_maybeyield = false +enable_host_guest_stack_synchronization = true +enable_incorrect_roundingmode_behavior = false +enable_rmw_context_merging = false +instrument_call_times = false +max_stackpoints = 65536 +x64_extension_mask = -1 +xop_arithmetic_right_shifts = false +xop_compares = true +xop_left_shifts = false +xop_right_shifts = false +xop_rotates = false +----------- END OF CONFIG DUMP ---- +i> 000000D4 Loaded config: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\xenia-canary.config.toml +i> 000000D4 Content root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\content +i> 000000D4 Host cache root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\cache_host +w> 000000D4 Unable to load Japanese font; JP characters will be boxes +w> 000000D4 Unable to load Japanese font; JP characters will be boxes +i> 00000124 Setup: Initializing Memory... +i> 00000124 Setup: Initializing Exports... +i> 00000124 Setup: Initializing Processor... +i> 00000124 Setup: Initializing Audio... +i> 00000124 Setup: Initializing Graphics... +i> 00000124 Setup: Initializing HID... +i> 00000124 winkey: "0x08" binds key 0x8 to controller input GUIDE. +i> 00000124 winkey: "^A" binds key 0x41 to controller input DPAD_LEFT. +i> 00000124 winkey: "^D" binds key 0x44 to controller input DPAD_RIGHT. +i> 00000124 winkey: "^S" binds key 0x53 to controller input DPAD_DOWN. +i> 00000124 winkey: "^W" binds key 0x57 to controller input DPAD_UP. +i> 00000124 winkey: "_A" binds key 0x41 to controller input LEFT_THUMB_LEFT. +i> 00000124 winkey: "_D" binds key 0x44 to controller input LEFT_THUMB_RIGHT. +i> 00000124 winkey: "_S" binds key 0x53 to controller input LEFT_THUMB_DOWN. +i> 00000124 winkey: "_W" binds key 0x57 to controller input LEFT_THUMB_UP. +i> 00000124 winkey: "F" binds key 0x46 to controller input LEFT_THUMB_PRESSED. +i> 00000124 winkey: "0x26" binds key 0x26 to controller input RIGHT_THUMB_UP. +i> 00000124 winkey: "0x28" binds key 0x28 to controller input RIGHT_THUMB_DOWN. +i> 00000124 winkey: "0x27" binds key 0x27 to controller input RIGHT_THUMB_RIGHT. +i> 00000124 winkey: "0x25" binds key 0x25 to controller input RIGHT_THUMB_LEFT. +i> 00000124 winkey: "K" binds key 0x4B to controller input RIGHT_THUMB_PRESSED. +i> 00000124 winkey: "L" binds key 0x4C to controller input X. +i> 00000124 winkey: "0xDE" binds key 0xDE to controller input B. +i> 00000124 winkey: "0xBA" binds key 0xBA to controller input A. +i> 00000124 winkey: "P" binds key 0x50 to controller input Y. +i> 00000124 winkey: "Q" binds key 0x51 to controller input LEFT_TRIGGER. +i> 00000124 winkey: "I" binds key 0x49 to controller input LEFT_TRIGGER. +i> 00000124 winkey: "E" binds key 0x45 to controller input RIGHT_TRIGGER. +i> 00000124 winkey: "O" binds key 0x4F to controller input RIGHT_TRIGGER. +i> 00000124 winkey: "Z" binds key 0x5A to controller input BACK. +i> 00000124 winkey: "X" binds key 0x58 to controller input START. +i> 00000124 winkey: "1" binds key 0x31 to controller input LEFT_SHOULDER. +i> 00000124 winkey: "3" binds key 0x33 to controller input RIGHT_SHOULDER. +i> 000000D4 SDL Version 2.32.2 initialized. +w> 000000D4 SDL GameControllerDB: file 'gamecontrollerdb.txt' does not exist. +i> 00000124 Setup: Initializing VFS... +i> 00000124 PatchDB: Loaded patches for 0 titles +i> 00000124 Setup: Initializing Kernel... +i> 00000124 ProfileManager: Found 0 Profiles +w> 00000124 BaseHeap::AllocFixed attempting commit on unreserved page +w> 00000124 BaseHeap::AllocFixed attempting commit on unreserved page +i> 00000124 Setup: Starting graphics_system... +i> 00000124 DXGI adapter: NVIDIA GeForce GTX 1070 Ti (vendor 0x1002, device 0x73DF) +i> 00000124 Direct3D 12 device and OS features: +* Max GPU virtual address bits per resource: 40 +* Non-zeroed heap creation: yes +* Pixel-shader-specified stencil reference: no +* Programmable sample positions: tier 0 +* Rasterizer-ordered views: yes +* Resource binding: tier 3 +* Tiled resources: tier 4 +* Unaligned block-compressed textures: yes +i> 00000124 XThread01000010 (1) Stack: 70010000-70030000 +i> 00000124 XThread01000014 (2) Stack: 70050000-70070000 +i> 00000124 Setup: Starting audio_system... +K> 01000010 XThread::Execute thid 1 (handle=01000010, 'GPU Commands (01000010)', native=00000154, ) +K> 01000014 XThread::Execute thid 2 (handle=01000014, 'GPU Frame limiter (01000014)', native=00000158, ) +i> 00000124 XThread01000018 (3) Stack: 70090000-700B0000 +i> 00000124 XThread0100001C (4) Stack: 700D0000-700F0000 +K> 01000018 XThread::Execute thid 3 (handle=01000018, 'XMA Decoder (01000018)', native=00000180, ) +K> 0100001C XThread::Execute thid 4 (handle=0100001C, 'Audio Worker (0100001C)', native=00000184, ) +i> 000000D4 Checking for XISO +F> 000000D4 DiscImageDevice::Initialize +i> 000000D4 Checking for XISO +F> 000000D4 DiscImageDevice::Initialize +F> 000000D4 DiscImageDevice::Initialize +i> 000000D4 Loading module GAME:\default.xex +F> 000000D4 DiscImageDevice::ResolvePath(\default.xex) +i> 000000D4 Module \Device\Cdrom0\default.xex: +Module Hash: CCF935D24A74E002 + Module Flags: 00000001 + XEX_MODULE_TITLE +Security Header: + Image Flags: 00000008 + XEX_IMAGE_XGD2_MEDIA_ONLY + Load Address: 82000000 + Image Size: 00920000 + Export Table: 00000000 +Optional Header Count: 15 + XEX_HEADER_RESOURCE_INFO: + 535107D4 828FB900-8291D8CF, 139215b + XEX_HEADER_FILE_FORMAT_INFO: + Info Size: 36 + Encryption Type: Normal + Compression Type: Normal + Window Size: 32768 + Block Size: 61440 + Block Hash: B3 2B D7 D4 EF 96 9A C5 9F D7 77 C6 8A 99 AA 1C BD 87 1C BE 00 90 2E F1 46 3F A3 D7 00 00 00 10 + XEX_HEADER_ENTRY_POINT: 824AB748 + XEX_HEADER_IMAGE_BASE_ADDRESS: 82000000 + XEX_HEADER_IMPORT_LIBRARIES: + xam.xex - 104 imports + Version: 2.0.4552.0 + Min Version: 2.0.4552.0 + xboxkrnl.exe - 294 imports + Version: 2.0.4552.0 + Min Version: 2.0.4552.0 + XEX_HEADER_CHECKSUM_TIMESTAMP: + Checksum : 00902EF1 + Time Stamp: 463FA3D7 - Tue May 8 00:10:31 2007 + XEX_HEADER_ORIGINAL_PE_NAME: default.pe + XEX_HEADER_STATIC_LIBRARIES: + XAPILIB : 2.0.3215.0 + D3D9 : 2.0.3215.1 + D3DX9 : 2.0.3215.0 + XBOXKRNL : 2.0.3215.0 + XAUD : 2.0.3215.0 + LIBCPMT : 2.0.3215.0 + XMP : 2.0.3215.0 + XMEDIA : 2.0.3215.0 + XONLINE : 2.0.3215.0 + XGRAPHC : 2.0.3215.0 + X3DAUD : 2.0.3215.1 + XACT : 2.0.3215.1 + XEX_HEADER_TLS_INFO: + Slot Count: 64 + Raw Data Address: 00000000 + Data Size: 0 + Raw Data Size: 0 + XEX_HEADER_DEFAULT_STACK_SIZE: 524288 + XEX_HEADER_SYSTEM_FLAGS: 00000400 + XEX_SYSTEM_PAL50_INCOMPATIBLE + XEX_HEADER_EXECUTION_INFO: + Media ID: 2D2E2EEB + Title ID: 535107D4 + Savegame ID: 535107D4 + Disc Number / Total: 1 / 1 + XEX_HEADER_GAME_RATINGS: + ESRB: Teen + PEGI: 12+ + PEGI-FI: 11+ + PEGI - PT: 12+ + BBFC: 12+ + CERO: Unrated + USK: Approved for children aged 12 and above + OFLC - AU: Parental Guidance + OFLC - NZ: Parental Guidance + KMRB: Unrated + Brazil: Unrated + FPB: 13+ + XEX_HEADER_LAN_KEY: E0 3C EA 47 3C AE 06 62 98 8F DB 7F 58 50 12 38 + XEX_HEADER_XBOX360_LOGO: + Section Size: 1736 + Logo Size: 1728 +Sections: + 0 RODATA 1 pages 82000000 - 82010000 (65536 bytes) + 1 RODATA 1 pages 82010000 - 82020000 (65536 bytes) + 2 RODATA 1 pages 82020000 - 82030000 (65536 bytes) + 3 RODATA 1 pages 82030000 - 82040000 (65536 bytes) + 4 RODATA 1 pages 82040000 - 82050000 (65536 bytes) + 5 RODATA 1 pages 82050000 - 82060000 (65536 bytes) + 6 RODATA 1 pages 82060000 - 82070000 (65536 bytes) + 7 RODATA 1 pages 82070000 - 82080000 (65536 bytes) + 8 RODATA 1 pages 82080000 - 82090000 (65536 bytes) + 9 RODATA 1 pages 82090000 - 820A0000 (65536 bytes) + 10 RODATA 1 pages 820A0000 - 820B0000 (65536 bytes) + 11 RODATA 1 pages 820B0000 - 820C0000 (65536 bytes) + 12 RODATA 1 pages 820C0000 - 820D0000 (65536 bytes) + 13 RODATA 1 pages 820D0000 - 820E0000 (65536 bytes) + 14 RODATA 1 pages 820E0000 - 820F0000 (65536 bytes) + 15 RODATA 1 pages 820F0000 - 82100000 (65536 bytes) + 16 RODATA 1 pages 82100000 - 82110000 (65536 bytes) + 17 RODATA 1 pages 82110000 - 82120000 (65536 bytes) + 18 RODATA 1 pages 82120000 - 82130000 (65536 bytes) + 19 RODATA 1 pages 82130000 - 82140000 (65536 bytes) + 20 RODATA 1 pages 82140000 - 82150000 (65536 bytes) + 21 CODE 1 pages 82150000 - 82160000 (65536 bytes) + 22 CODE 1 pages 82160000 - 82170000 (65536 bytes) + 23 CODE 1 pages 82170000 - 82180000 (65536 bytes) + 24 CODE 1 pages 82180000 - 82190000 (65536 bytes) + 25 CODE 1 pages 82190000 - 821A0000 (65536 bytes) + 26 CODE 1 pages 821A0000 - 821B0000 (65536 bytes) + 27 CODE 1 pages 821B0000 - 821C0000 (65536 bytes) + 28 CODE 1 pages 821C0000 - 821D0000 (65536 bytes) + 29 CODE 1 pages 821D0000 - 821E0000 (65536 bytes) + 30 CODE 1 pages 821E0000 - 821F0000 (65536 bytes) + 31 CODE 1 pages 821F0000 - 82200000 (65536 bytes) + 32 CODE 1 pages 82200000 - 82210000 (65536 bytes) + 33 CODE 1 pages 82210000 - 82220000 (65536 bytes) + 34 CODE 1 pages 82220000 - 82230000 (65536 bytes) + 35 CODE 1 pages 82230000 - 82240000 (65536 bytes) + 36 CODE 1 pages 82240000 - 82250000 (65536 bytes) + 37 CODE 1 pages 82250000 - 82260000 (65536 bytes) + 38 CODE 1 pages 82260000 - 82270000 (65536 bytes) + 39 CODE 1 pages 82270000 - 82280000 (65536 bytes) + 40 CODE 1 pages 82280000 - 82290000 (65536 bytes) + 41 CODE 1 pages 82290000 - 822A0000 (65536 bytes) + 42 CODE 1 pages 822A0000 - 822B0000 (65536 bytes) + 43 CODE 1 pages 822B0000 - 822C0000 (65536 bytes) + 44 CODE 1 pages 822C0000 - 822D0000 (65536 bytes) + 45 CODE 1 pages 822D0000 - 822E0000 (65536 bytes) + 46 CODE 1 pages 822E0000 - 822F0000 (65536 bytes) + 47 CODE 1 pages 822F0000 - 82300000 (65536 bytes) + 48 CODE 1 pages 82300000 - 82310000 (65536 bytes) + 49 CODE 1 pages 82310000 - 82320000 (65536 bytes) + 50 CODE 1 pages 82320000 - 82330000 (65536 bytes) + 51 CODE 1 pages 82330000 - 82340000 (65536 bytes) + 52 CODE 1 pages 82340000 - 82350000 (65536 bytes) + 53 CODE 1 pages 82350000 - 82360000 (65536 bytes) + 54 CODE 1 pages 82360000 - 82370000 (65536 bytes) + 55 CODE 1 pages 82370000 - 82380000 (65536 bytes) + 56 CODE 1 pages 82380000 - 82390000 (65536 bytes) + 57 CODE 1 pages 82390000 - 823A0000 (65536 bytes) + 58 CODE 1 pages 823A0000 - 823B0000 (65536 bytes) + 59 CODE 1 pages 823B0000 - 823C0000 (65536 bytes) + 60 CODE 1 pages 823C0000 - 823D0000 (65536 bytes) + 61 CODE 1 pages 823D0000 - 823E0000 (65536 bytes) + 62 CODE 1 pages 823E0000 - 823F0000 (65536 bytes) + 63 CODE 1 pages 823F0000 - 82400000 (65536 bytes) + 64 CODE 1 pages 82400000 - 82410000 (65536 bytes) + 65 CODE 1 pages 82410000 - 82420000 (65536 bytes) + 66 CODE 1 pages 82420000 - 82430000 (65536 bytes) + 67 CODE 1 pages 82430000 - 82440000 (65536 bytes) + 68 CODE 1 pages 82440000 - 82450000 (65536 bytes) + 69 CODE 1 pages 82450000 - 82460000 (65536 bytes) + 70 CODE 1 pages 82460000 - 82470000 (65536 bytes) + 71 CODE 1 pages 82470000 - 82480000 (65536 bytes) + 72 CODE 1 pages 82480000 - 82490000 (65536 bytes) + 73 CODE 1 pages 82490000 - 824A0000 (65536 bytes) + 74 CODE 1 pages 824A0000 - 824B0000 (65536 bytes) + 75 CODE 1 pages 824B0000 - 824C0000 (65536 bytes) + 76 CODE 1 pages 824C0000 - 824D0000 (65536 bytes) + 77 CODE 1 pages 824D0000 - 824E0000 (65536 bytes) + 78 CODE 1 pages 824E0000 - 824F0000 (65536 bytes) + 79 CODE 1 pages 824F0000 - 82500000 (65536 bytes) + 80 CODE 1 pages 82500000 - 82510000 (65536 bytes) + 81 CODE 1 pages 82510000 - 82520000 (65536 bytes) + 82 CODE 1 pages 82520000 - 82530000 (65536 bytes) + 83 CODE 1 pages 82530000 - 82540000 (65536 bytes) + 84 CODE 1 pages 82540000 - 82550000 (65536 bytes) + 85 CODE 1 pages 82550000 - 82560000 (65536 bytes) + 86 CODE 1 pages 82560000 - 82570000 (65536 bytes) + 87 CODE 1 pages 82570000 - 82580000 (65536 bytes) + 88 CODE 1 pages 82580000 - 82590000 (65536 bytes) + 89 CODE 1 pages 82590000 - 825A0000 (65536 bytes) + 90 CODE 1 pages 825A0000 - 825B0000 (65536 bytes) + 91 CODE 1 pages 825B0000 - 825C0000 (65536 bytes) + 92 CODE 1 pages 825C0000 - 825D0000 (65536 bytes) + 93 CODE 1 pages 825D0000 - 825E0000 (65536 bytes) + 94 CODE 1 pages 825E0000 - 825F0000 (65536 bytes) + 95 CODE 1 pages 825F0000 - 82600000 (65536 bytes) + 96 CODE 1 pages 82600000 - 82610000 (65536 bytes) + 97 CODE 1 pages 82610000 - 82620000 (65536 bytes) + 98 CODE 1 pages 82620000 - 82630000 (65536 bytes) + 99 CODE 1 pages 82630000 - 82640000 (65536 bytes) + 100 CODE 1 pages 82640000 - 82650000 (65536 bytes) + 101 CODE 1 pages 82650000 - 82660000 (65536 bytes) + 102 CODE 1 pages 82660000 - 82670000 (65536 bytes) + 103 CODE 1 pages 82670000 - 82680000 (65536 bytes) + 104 CODE 1 pages 82680000 - 82690000 (65536 bytes) + 105 CODE 1 pages 82690000 - 826A0000 (65536 bytes) + 106 CODE 1 pages 826A0000 - 826B0000 (65536 bytes) + 107 CODE 1 pages 826B0000 - 826C0000 (65536 bytes) + 108 CODE 1 pages 826C0000 - 826D0000 (65536 bytes) + 109 CODE 1 pages 826D0000 - 826E0000 (65536 bytes) + 110 CODE 1 pages 826E0000 - 826F0000 (65536 bytes) + 111 CODE 1 pages 826F0000 - 82700000 (65536 bytes) + 112 CODE 1 pages 82700000 - 82710000 (65536 bytes) + 113 CODE 1 pages 82710000 - 82720000 (65536 bytes) + 114 CODE 1 pages 82720000 - 82730000 (65536 bytes) + 115 CODE 1 pages 82730000 - 82740000 (65536 bytes) + 116 CODE 1 pages 82740000 - 82750000 (65536 bytes) + 117 CODE 1 pages 82750000 - 82760000 (65536 bytes) + 118 CODE 1 pages 82760000 - 82770000 (65536 bytes) + 119 CODE 1 pages 82770000 - 82780000 (65536 bytes) + 120 CODE 1 pages 82780000 - 82790000 (65536 bytes) + 121 CODE 1 pages 82790000 - 827A0000 (65536 bytes) + 122 CODE 1 pages 827A0000 - 827B0000 (65536 bytes) + 123 CODE 1 pages 827B0000 - 827C0000 (65536 bytes) + 124 CODE 1 pages 827C0000 - 827D0000 (65536 bytes) + 125 CODE 1 pages 827D0000 - 827E0000 (65536 bytes) + 126 CODE 1 pages 827E0000 - 827F0000 (65536 bytes) + 127 CODE 1 pages 827F0000 - 82800000 (65536 bytes) + 128 CODE 1 pages 82800000 - 82810000 (65536 bytes) + 129 CODE 1 pages 82810000 - 82820000 (65536 bytes) + 130 CODE 1 pages 82820000 - 82830000 (65536 bytes) + 131 CODE 1 pages 82830000 - 82840000 (65536 bytes) + 132 CODE 1 pages 82840000 - 82850000 (65536 bytes) + 133 CODE 1 pages 82850000 - 82860000 (65536 bytes) + 134 CODE 1 pages 82860000 - 82870000 (65536 bytes) + 135 RWDATA 1 pages 82870000 - 82880000 (65536 bytes) + 136 RWDATA 1 pages 82880000 - 82890000 (65536 bytes) + 137 RWDATA 1 pages 82890000 - 828A0000 (65536 bytes) + 138 RWDATA 1 pages 828A0000 - 828B0000 (65536 bytes) + 139 RWDATA 1 pages 828B0000 - 828C0000 (65536 bytes) + 140 RWDATA 1 pages 828C0000 - 828D0000 (65536 bytes) + 141 RWDATA 1 pages 828D0000 - 828E0000 (65536 bytes) + 142 RWDATA 1 pages 828E0000 - 828F0000 (65536 bytes) + 143 RWDATA 1 pages 828F0000 - 82900000 (65536 bytes) + 144 RWDATA 1 pages 82900000 - 82910000 (65536 bytes) + 145 RWDATA 1 pages 82910000 - 82920000 (65536 bytes) +Imports: + xam - 52 imports + Version: 0.0.4552.32 + Min Version: 0.0.4552.32 + + Total: 52 + Known: 100% (52 known, 0 unknown) + Implemented: 98% (51 implemented, 1 unimplemented) + + F 82000600 8284DA7C 28C ( 652) XNotifyPositionUI + F 82000604 8284DA8C 2BC ( 700) XamShowSigninUI + F 82000608 8284DA9C 2C1 ( 705) XamShowKeyboardUI + F 8200060C 8284DAAC 2D5 ( 725) !! XamShowGamerCardUIForXUID + F 82000610 8284DABC 2CB ( 715) XamShowDeviceSelectorUI + F 82000614 8284DACC 2D9 ( 729) XamShowDirtyDiscErrorUI + F 82000618 8284DADC 1B3 ( 435) XamTaskShouldExit + F 8200061C 8284DAEC 1B1 ( 433) XamTaskCloseHandle + F 82000620 8284DAFC 1AF ( 431) XamTaskSchedule + F 82000624 8284DB0C 1A4 ( 420) XamLoaderLaunchTitle + F 82000628 8284DB1C 1F7 ( 503) XMsgStartIORequest + F 8200062C 8284DB2C 20E ( 526) XamUserGetName + F 82000630 8284DB3C 210 ( 528) XamUserGetSigninState + F 82000634 8284DB4C 282 ( 642) XamGetSystemVersion + F 82000638 8284DB5C 2F7 ( 759) XamUserCreateStatsEnumerator + F 8200063C 8284DB6C 2EE ( 750) XamUserCreateAchievementEnumerator + F 82000640 8284DB7C 20A ( 522) XamUserGetXUID + F 82000644 8284DB8C 250 ( 592) XamEnumerate + F 82000648 8284DB9C 3CC ( 972) XGetGameRegion + F 8200064C 8284DBAC 190 ( 400) XamInputGetCapabilities + F 82000650 8284DBBC 191 ( 401) XamInputGetState + F 82000654 8284DBCC 192 ( 402) XamInputSetState + F 82000658 8284DBDC 198 ( 408) XamInputGetKeystrokeEx + F 8200065C 8284DBEC 258 ( 600) XamContentCreate + F 82000660 8284DBFC 25B ( 603) XamContentDelete + F 82000664 8284DC0C 25A ( 602) XamContentClose + F 82000668 8284DC1C 260 ( 608) XamContentSetThumbnail + F 8200066C 8284DC2C 262 ( 610) XamContentGetCreator + F 82000670 8284DC3C 25C ( 604) XamContentCreateEnumerator + F 82000674 8284DC4C 265 ( 613) XamContentGetDeviceState + F 82000678 8284DC5C 25E ( 606) XamContentGetDeviceData + F 8200067C 8284DC6C 25F ( 607) XamContentGetDeviceName + F 82000680 8284DC7C 1A0 ( 416) XamEnableInactivityProcessing + F 82000684 8284DC8C 1A1 ( 417) XamResetInactivity + F 82000688 8284DC9C 2DC ( 732) XamShowMessageBoxUIEx + F 8200068C 8284DCAC 3CD ( 973) XGetLanguage + F 82000690 8284DCBC 3CB ( 971) XGetAVPack + F 82000694 8284DCCC 1A9 ( 425) XamLoaderTerminateTitle + F 82000698 8284DCDC 280 ( 640) XamGetExecutionId + F 8200069C 8284E45C 28B ( 651) XNotifyGetNext + F 820006A0 8284E44C 002 ( 2) NetDll_WSACleanup + F 820006A4 8284E43C 001 ( 1) NetDll_WSAStartup + F 820006A8 8284E46C 28A ( 650) XamNotifyCreateListener + F 820006AC 8284E42C 316 ( 790) XamSessionCreateHandle + F 820006B0 8284E41C 317 ( 791) XamSessionRefObjByHandle + F 820006B4 8284E40C 21A ( 538) XamUserWriteProfileSettings + F 820006B8 8284E3FC 219 ( 537) XamUserReadProfileSettings + F 820006BC 8284E3EC 1EA ( 490) XamAlloc + F 820006C0 8284E3DC 1EC ( 492) XamFree + F 820006C4 8284E3CC 3D1 ( 977) XGetVideoMode + F 820006C8 8284E3BC 1F4 ( 500) XMsgInProcessCall + F 820006CC 8284E3AC 1FC ( 508) XMsgStartIORequestEx + + xboxkrnl - 152 imports + Version: 0.0.4552.32 + Min Version: 0.0.4552.32 + + Total: 152 + Known: 100% (152 known, 0 unknown) + Implemented: 95% (145 implemented, 7 unimplemented) + + F 820006D4 8284E1FC 0B4 ( 180) KfReleaseSpinLock + F 820006D8 8284E20C 0B1 ( 177) KfAcquireSpinLock + F 820006DC 8284E21C 1DF ( 479) KiApcNormalRoutineNop + F 820006E0 8284E22C 1B6 ( 438) VdEnableRingBufferRPtrWriteBack + F 820006E4 8284E23C 1C3 ( 451) VdInitializeRingBuffer + F 820006E8 8284E24C 0BE ( 190) MmGetPhysicalAddress + F 820006EC 8284E25C 1D9 ( 473) VdSetSystemCommandBufferGpuIdentifierAddress + F 820006F0 8284E26C 13B ( 315) sprintf + F 820006F4 8284E27C 1B9 ( 441) VdGetCurrentDisplayGamma + V 820006F8 266 ( 614) KeCertMonitorData + F 820006FC 8284E28C 14D ( 333) _vsnprintf + V 82000700 158 ( 344) XboxKrnlVersion + F 82000704 8284E29C 1DC ( 476) VdShutdownEngines + F 82000708 8284E2AC 1CA ( 458) VdQueryVideoMode + F 8200070C 8284E2BC 1BA ( 442) VdGetCurrentDisplayInformation + F 82000710 8284E2CC 1D3 ( 467) VdSetDisplayMode + F 82000714 8284E2DC 1D5 ( 469) VdSetGraphicsInterruptCallback + F 82000718 8284E2EC 1C2 ( 450) VdInitializeEngines + F 8200071C 8284E2FC 1C6 ( 454) VdIsHSIOTrainingSucceeded + F 82000720 8284E30C 1C9 ( 457) VdQueryVideoFlags + F 82000724 8284E31C 1B1 ( 433) VdCallGraphicsNotificationRoutines + V 82000728 1C0 ( 448) VdGpuClockInMHz + F 8200072C 8284E32C 1C5 ( 453) VdInitializeScalerCommandBuffer + F 82000730 8284E33C 269 ( 617) VdRetrainEDRAM + F 82000734 8284E34C 26A ( 618) VdRetrainEDRAMWorker + V 82000738 1C1 ( 449) VdHSIOCalibrationLock + F 8200073C 8284E35C 06B ( 107) KeLockL2 + F 82000740 8284E36C 06C ( 108) KeUnlockL2 + F 82000744 8284E37C 1C7 ( 455) VdPersistDisplay + F 82000748 8284E38C 25B ( 603) VdSwap + F 8200074C 8284E39C 1BD ( 445) VdGetSystemCommandBuffer + V 82000750 1BE ( 446) VdGlobalDevice + F 82000754 8284E1EC 04D ( 77) KeAcquireSpinLockAtRaisedIrql + F 82000758 8284E1DC 089 ( 137) KeReleaseSpinLockFromRaisedIrql + F 8200075C 8284E1CC 1B4 ( 436) VdEnableDisableClockGating + F 82000760 8284E1BC 13F ( 319) RtlTimeFieldsToTime + F 82000764 8284E1AC 136 ( 310) RtlRaiseException + F 82000768 8284E19C 0EE ( 238) NtQueryVirtualMemory + F 8200076C 8284E18C 11B ( 283) RtlCompareMemoryUlong + F 82000770 8284E17C 066 ( 102) KeGetCurrentProcessType + F 82000774 8284E16C 053 ( 83) KeBugCheckEx + F 82000778 8284E15C 126 ( 294) RtlFillMemoryUlong + V 8200077C 1AE ( 430) ExLoadedCommandLine + F 82000780 8284E14C 05A ( 90) KeDelayExecutionThread + F 82000784 8284E13C 143 ( 323) RtlUnicodeToMultiByteN + F 82000788 8284E12C 0E4 ( 228) NtQueryDirectoryFile + F 8200078C 8284E10C 019 ( 25) ExTerminateThread + F 82000790 8284E0FC 09B ( 155) KeSetCurrentStackPointers + F 82000794 8284E0EC 197 ( 407) XexGetProcedureAddress + F 82000798 8284E0DC 03C ( 60) !! IoDismountVolumeByFileHandle + F 8200079C 8284E0CC 0D9 ( 217) NtDeviceIoControlFile + F 820007A0 8284E0BC 028 ( 40) HalReturnToFirmware + F 820007A4 8284E0AC 003 ( 3) DbgPrint + F 820007A8 8284E09C 140 ( 320) RtlTimeToTimeFields + F 820007AC 8284E08C 0FE ( 254) NtWaitForMultipleObjectsEx + F 820007B0 8284E07C 0F3 ( 243) NtReleaseSemaphore + F 820007B4 8284E06C 0D5 ( 213) NtCreateSemaphore + F 820007B8 8284E05C 084 ( 132) KeQuerySystemTime + F 820007BC 8284E04C 0E8 ( 232) NtQueryInformationFile + F 820007C0 8284E03C 0F7 ( 247) NtSetInformationFile + F 820007C4 8284E02C 0FD ( 253) NtWaitForSingleObjectEx + F 820007C8 8284E01C 0CE ( 206) NtClearEvent + F 820007CC 8284E00C 0F5 ( 245) NtResumeThread + V 820007D0 0AD ( 173) KeTimeStampBundle + F 820007D4 8284DFFC 010 ( 16) ExGetXConfigSetting + V 820007D8 059 ( 89) KeDebugMonitorData + F 820007DC 8284DFEC 097 ( 151) KeSetAffinityThread + F 820007E0 8284DFDC 0FC ( 252) NtSuspendThread + F 820007E4 8284DFCC 081 ( 129) KeQueryBasePriorityThread + V 820007E8 01B ( 27) ExThreadObjectType + F 820007EC 8284DFBC 110 ( 272) ObReferenceObjectByHandle + F 820007F0 8284DFAC 099 ( 153) KeSetBasePriorityThread + F 820007F4 8284DF9C 10B ( 267) ObLookupThreadByThreadId + F 820007F8 8284DF8C 10E ( 270) ObOpenObjectByPointer + F 820007FC 8284DF7C 0DA ( 218) NtDuplicateObject + F 82000800 8284DF6C 101 ( 257) NtYieldExecution + F 82000804 8284DF5C 0F6 ( 246) NtSetEvent + F 82000808 8284DF4C 052 ( 82) KeBugCheck + F 8200080C 8284DF3C 0BC ( 188) MmDeleteKernelStack + F 82000810 8284DF2C 0BB ( 187) MmCreateKernelStack + F 82000814 8284DF1C 0D1 ( 209) NtCreateEvent + F 82000818 8284DF0C 135 ( 309) RtlNtStatusToDosError + F 8200081C 8284DEFC 194 ( 404) XexCheckExecutablePrivilege + F 82000820 8284DEEC 05F ( 95) KeEnterCriticalRegion + F 82000824 8284DEDC 07D ( 125) KeLeaveCriticalRegion + F 82000828 8284DECC 0CC ( 204) NtAllocateVirtualMemory + F 8200082C 8284DEBC 259 ( 601) !! StfsCreateDevice + F 82000830 8284DEAC 103 ( 259) ObCreateSymbolicLink + F 82000834 8284DE9C 25A ( 602) !! StfsControlDevice + F 82000838 8284DE8C 0DB ( 219) NtFlushBuffersFile + F 8200083C 8284DE7C 104 ( 260) ObDeleteSymbolicLink + F 82000840 8284DE6C 105 ( 261) ObDereferenceObject + F 82000844 8284DE5C 0DC ( 220) NtFreeVirtualMemory + F 82000848 8284DE4C 0D2 ( 210) NtCreateFile + F 8200084C 8284DE3C 256 ( 598) XeKeysConsolePrivateKeySign + F 82000850 8284DE2C 0F0 ( 240) NtReadFile + F 82000854 8284DE1C 0FF ( 255) NtWriteFile + F 82000858 8284DE0C 192 ( 402) XeCryptSha + F 8200085C 8284DDFC 257 ( 599) !! XeKeysConsoleSignatureVerification + F 82000860 8284DDEC 015 ( 21) ExRegisterTitleTerminateNotification + F 82000864 8284DDDC 09D ( 157) KeSetEvent + F 82000868 8284DDCC 0B0 ( 176) KeWaitForSingleObject + F 8200086C 8284DDBC 08F ( 143) KeResetEvent + V 82000870 193 ( 403) XexExecutableModuleHandle + F 82000874 8284DDAC 12B ( 299) RtlImageXexHeaderField + F 82000878 8284DD9C 1A5 ( 421) !! __C_specific_handler + F 8200087C 8284DD8C 12C ( 300) RtlInitAnsiString + F 82000880 8284DD7C 0DF ( 223) NtOpenFile + F 82000884 8284DD6C 0CF ( 207) NtClose + F 82000888 8284DD5C 0EF ( 239) NtQueryVolumeInformationFile + F 8200088C 8284DD4C 0C4 ( 196) MmQueryAddressProtect + F 82000890 8284DD3C 0BD ( 189) MmFreePhysicalMemory + F 82000894 8284DD2C 0BA ( 186) MmAllocatePhysicalMemoryEx + F 82000898 8284DD1C 12E ( 302) RtlInitializeCriticalSection + F 8200089C 8284DD0C 130 ( 304) RtlLeaveCriticalSection + F 820008A0 8284DCFC 125 ( 293) RtlEnterCriticalSection + F 820008A4 8284DCEC 12F ( 303) RtlInitializeCriticalSectionAndSpinCount + F 820008A8 8284E11C 00D ( 13) ExCreateThread + F 820008AC 8284E47C 085 ( 133) KeRaiseIrqlToDpcLevel + F 820008B0 8284E48C 0B3 ( 179) KfLowerIrql + F 820008B4 8284E49C 088 ( 136) KeReleaseSemaphore + F 820008B8 8284E4AC 1F8 ( 504) XAudioGetVoiceCategoryVolume + F 820008BC 8284E4BC 1F7 ( 503) XAudioGetVoiceCategoryVolumeChangeMask + F 820008C0 8284E4CC 0AF ( 175) KeWaitForMultipleObjects + F 820008C4 8284E4DC 092 ( 146) KeResumeThread + F 820008C8 8284E4EC 074 ( 116) KeInitializeSemaphore + F 820008CC 8284E4FC 226 ( 550) XMAReleaseContext + F 820008D0 8284E50C 224 ( 548) XMACreateContext + F 820008D4 8284E51C 083 ( 131) KeQueryPerformanceFrequency + F 820008D8 8284E52C 141 ( 321) RtlTryEnterCriticalSection + F 820008DC 8284E53C 0AE ( 174) KeTryToAcquireSpinLockAtRaisedIrql + F 820008E0 8284E54C 1F3 ( 499) XAudioRegisterRenderDriverClient + F 820008E4 8284E55C 1F4 ( 500) XAudioUnregisterRenderDriverClient + F 820008E8 8284E56C 1F5 ( 501) XAudioSubmitRenderDriverFrame + F 820008EC 8284E57C 195 ( 405) XexGetModuleHandle + F 820008F0 8284E58C 147 ( 327) !! RtlUnwind + F 820008F4 8284E59C 152 ( 338) KeTlsAlloc + F 820008F8 8284E5AC 154 ( 340) KeTlsGetValue + F 820008FC 8284E5BC 155 ( 341) KeTlsSetValue + F 82000900 8284E5CC 153 ( 339) KeTlsFree + F 82000904 8284E5DC 119 ( 281) !! RtlCaptureContext + F 82000908 8284E5EC 05D ( 93) KeEnableFpuExceptions + F 8200090C 8284E5FC 0C6 ( 198) MmQueryStatistics + F 82000910 8284E60C 0D7 ( 215) NtCreateTimer + F 82000914 8284E61C 0FA ( 250) NtSetTimerEx + F 82000918 8284E62C 0CD ( 205) NtCancelTimer + F 8200091C 8284E63C 0E7 ( 231) NtQueryFullAttributesFile + F 82000920 8284E64C 127 ( 295) RtlFreeAnsiString + F 82000924 8284E65C 142 ( 322) RtlUnicodeStringToAnsiString + F 82000928 8284E66C 12D ( 301) RtlInitUnicodeString + F 8200092C 8284E67C 133 ( 307) RtlMultiByteToUnicodeN + F 82000930 8284E68C 001 ( 1) DbgBreakPoint + +w> 000000D4 GameDatabase: Title doesn't contain XLAST data! Multiplayer functionality might be limited. +i> 000000D4 Title name: PROJECT SYLPHEED +i> 000000D4 +-------------------- ACHIEVEMENTS -------------------- ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| ID | Title | Description | Type | Gamerscore | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 1 | Space Combat Award | Received after your first space battle in the Glasner Training Area. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 2 | Schlos Base Defense Award | Received for stopping the missile attack on Schlos Base. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 3 | Aegis of the People Medal | Received for escorting all 7 refugee ships to safety. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 4 | TCAF Luna Medal | Received for bravely helping the fleet escape during the invasion of the Matisse System. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 5 | TCAF Mars Medal | Received for bravery beyond the call of duty during the escape from the Matisse System. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 6 | Soldier's Charm Amulet | Given to you by Raymond as a token of his trust. | Event | 50 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 7 | White Griffons Patch | Received by the commander and pilots of the White Griffon Squadron when it is formed. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 8 | TCAF Jupiter Medal | Received for bravery during the enemy's attack on the Alberti System. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 9 | Furious Pursuit Badge | Received for continuing attacks on the enemy and shooting down a large number of ships. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 10 | Solo Aerospace Combat Award | Received for descending into Acheron's atmosphere and engaging in combat alone. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 11 | Operation Nebula Blaze Award | Received for completing the extremely hazardous Operation Nebula Blaze. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 12 | Guilty Roses Patch | Received for repelling the Guilty Roses Squadron. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 13 | Super Battleship Slayer Patch | Received for shooting down the second S battleship. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 14 | TCAF Terra Medal | Received for shielding the fleet and seeing that all ships safely fled the Ingres System. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 15 | Hellfires Patch | Received for repelling the enemy Hellfire Squadron. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 16 | Night Ravens Patch | Received for challenging and eradicating the Night Raven Squadron. | Event | 50 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 17 | Solar System Defense Award | Received for great achievements during the campaign to defend the Solar System. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 18 | Special Operations Medal | Received for heroically destroying the Prometheus Driver. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 19 | 1,000 Units Destroyed Medal | Received for shooting down 1,000 enemy fighters and attackers in combat. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 20 | 10,000 Units Destroyed Medal | Received for shooting down 10,000 enemy fighters and attackers in combat. | Event | 70 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 21 | Ship Hunter Award | Received for shooting down 100 enemy warships in combat. | Event | 50 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 22 | Gigaton Club Patch | Received for shooting down enemy vessels with a total weight of one gigaton. | Event | 70 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 23 | Weapon Lord Patch | Received after you collect all usable equipment for the Delta Saber. | Event | 80 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 24 | TCAF Pilot's Commendation | Commemmorates you as one of the greatest pilots in history. | Event | 100 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +i> 000000D4 +-------------------- PROPERTIES -------------------- ++----------+------------------+-------------+-----------+ +| ID | Name | Matchmaking | Data Size | ++----------+------------------+-------------+-----------+ +| 10000006 | Killed Aircrafts | False | 4 | ++----------+------------------+-------------+-----------+ +| 10000008 | Equipments | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000000A | Clear Time | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000000B | Killed Warships | False | 4 | ++----------+------------------+-------------+-----------+ +| 10008001 | Rank | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000800A | | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000800B | | False | 4 | ++----------+------------------+-------------+-----------+ +| 20000005 | Killed Weight | False | 8 | ++----------+------------------+-------------+-----------+ +| 20000007 | Clear Time | False | 8 | ++----------+------------------+-------------+-----------+ +| 20000009 | Earned Points | False | 8 | ++----------+------------------+-------------+-----------+ +| 40008002 | Gamer Name | False | 2 | ++----------+------------------+-------------+-----------+ +i> 000000D4 +-------------------- CONTEXTS -------------------- ++----------+-------------+-------------+---------------+-----------+ +| ID | Name | Matchmaking | Default Value | Max Value | ++----------+-------------+-------------+---------------+-----------+ +| 00000000 | Game Stage | False | 0 | 28 | ++----------+-------------+-------------+---------------+-----------+ +| 00000001 | Game Status | False | 0 | 9 | ++----------+-------------+-------------+---------------+-----------+ +| 00008001 | | False | 0 | 0 | ++----------+-------------+-------------+---------------+-----------+ +| 0000800A | Game Type | True | 0 | 1 | ++----------+-------------+-------------+---------------+-----------+ +| 0000800B | | True | 0 | 0 | ++----------+-------------+-------------+---------------+-----------+ +i> 000000D4 +-------------------- STATS VIEWS -------------------- ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| ID | View Type | Name | Skilled | Arbitrated | Hidden | Team View | Online Only | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000001 | Leaderboard | Time Attack (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000002 | Leaderboard | Score Attack (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000003 | Leaderboard | Extra 1 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000004 | Leaderboard | Extra 1 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000005 | Leaderboard | Extra 2 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000006 | Leaderboard | Extra 2 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000007 | Leaderboard | Extra 3 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000008 | Leaderboard | Extra 3 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000009 | Leaderboard | Extra 4 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 0000000A | Leaderboard | Extra 4 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 0000000C | Leaderboard | Time Attack (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 0000000D | Leaderboard | Score Attack (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| FFFF0000 | Leaderboard | | True | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +i> 000000D4 +-------------------- PRESENCE MODES -------------------- ++---------------+----------------+------------------+ +| Context Value | Contexts Count | Properties Count | ++---------------+----------------+------------------+ +| 0 | 2 | 0 | ++---------------+----------------+------------------+ +i> 000000D4 XThread01000020 (5) Stack: 70110000-70130000 +i> 000000D4 KernelState: Launching module... +i> 000000D4 XThreadF8000008 (6) Stack: 70150000-701D0000 +K> 01000020 XThread::Execute thid 5 (handle=01000020, 'Kernel Dispatch (01000020)', native=00000190, ) +K> F8000008 XThread::Execute thid 6 (handle=F8000008, 'Main XThread (F8000008)', native=00000194) +i> 01000010 Loaded 7 shaders from storage +i> 01000010 Loaded 4 pipeline descriptions, 8 shader translations needed +i> 01000010 Translated 7 shaders in 3 ms +i> 01000010 Pipeline cache loaded: 4 created, 0 already exist, 4 total stored +i> 01000010 Pipeline creation took 0 milliseconds +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800000C type=1 initial_state=0 lr=824A9F6C +F> F8000008 NullDevice::ResolvePath() +F> F8000008 NullDevice::ResolvePath() +F> F8000008 NullDevice::ResolvePath() +!> F8000008 undefined extern call to 8284E0DC IoDismountVolumeByFileHandle +F> F8000008 NullDevice::ResolvePath() +i> F8000008 Got xam task args: v1 = 02080002, v2 = 00000000 +i> F8000008 XThreadF8000010 (7) Stack: 701F0000-70270000 +K> F8000010 XThread::Execute thid 7 (handle=F8000010, 'XThread01B8 (F8000010)', native=000001B8) +F> F8000010 NullDevice::ResolvePath() +w> F8000010 Game is attempting to allocate devkit debug memory (base: 00000000, size: 000FF000). Ignoring debug flag and using normal allocation. +!> F8000010 undefined extern call to 8284DEBC StfsCreateDevice +K> F8000010 AUDIT-HLC KeSetEvent guest_ptr=8287094C lr=824A95D0 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000020 type=1 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000024 (8) Stack: 70290000-702B0000 +K> F8000024 XThread::Execute thid 8 (handle=F8000024, 'XThread01BC (F8000024)', native=000001BC) +K> F8000024 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000020 alertable=0 lr=824AC578 guest_lr=824AFFC4 +F> F8000008 HostPathDevice::ResolvePath() +i> F8000008 XThreadF800002C (9) Stack: 702D0000-702E0000 +K> F800002C XThread::Execute thid 9 (handle=F800002C, 'XThread01C0 (F800002C)', native=000001C0) +F> F800002C HostPathDevice::ResolvePath() +F> F800002C HostPathDevice::ResolvePath() +F> F8000008 HostPathDevice::ResolvePath(\d4ea4615\e\46ee8ca) +F> F8000008 HostPathDevice::ResolvePath(\d4ea4615\e) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800003C type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000040 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000048 (A) Stack: 70300000-70340000 +K> F8000048 XThread::Execute thid 10 (handle=F8000048, 'XThread01C4 (F8000048)', native=000001C4) +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800003C alertable=0 lr=824AC578 guest_lr=82452E64 +!> F800002C BaseHeap::Release failed because address is not a region start +!> F800002C PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000030 type=0 initial_state=0 lr=824A9F6C +F> F800002C HostPathDevice::ResolvePath() +F> F800002C HostPathDevice::ResolvePath() +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F800004C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800003C result=00000000 lr=824AC578 guest_lr=82452E64 +!> F800002C BaseHeap::Release failed because address is not a region start +!> F800002C PhysicalHeap::Release failed due to parent heap failure +K> F800002C AUDIT-HLC NtWaitForSingleObjectEx handle=F8000028 alertable=0 lr=824AC578 guest_lr=824AFFC4 +!> F8000008 BaseHeap::Release failed because address is not a region start +!> F8000008 PhysicalHeap::Release failed due to parent heap failure +!> F8000008 BaseHeap::Release failed because address is not a region start +!> F8000008 PhysicalHeap::Release failed due to parent heap failure +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\8\3421153) +F> F8000008 DiscImageDevice::ResolvePath(\dat) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\355f2f8) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000038 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800004C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800004C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000050 type=0 initial_state=0 lr=824A9F6C +i> F8000048 XThreadF8000058 (B) Stack: 70360000-70370000 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F800004C alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 XThread::Execute thid 11 (handle=F8000058, 'XThread01C8 (F8000058)', native=000001C8) +K> F8000058 AUDIT-HLC NtSetEvent handle=F800004C lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800004C result=00000000 lr=824AC578 guest_lr=8245148C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F800003C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=82452E64 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000038 type=1 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +i> F8000008 XThreadF800004C (C) Stack: 70390000-703A0000 +K> F800004C XThread::Execute thid 12 (handle=F800004C, 'XThread01CC (F800004C)', native=000001CC) +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +i> F8000008 Hardware scaler: width ratio 1:1, height ratio 1:1, final aspect ratio 16:9 +i> 01000010 Selecting rep movs vastcpy. +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000060 type=1 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000064 type=1 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000068 (D) Stack: 703C0000-70440000 +K> F8000068 XThread::Execute thid 13 (handle=F8000068, 'XThread01D0 (F8000068)', native=000001D0) +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +F> F8000008 HostPathDevice::ResolvePath(\aab216c3\a\2c8c185) +F> F8000008 HostPathDevice::ResolvePath(\aab216c3\a) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000070 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000070 alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000078 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 AUDIT-HLC NtSetEvent handle=F8000078 lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000078 result=00000000 lr=824AC578 guest_lr=8245148C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000074 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000070 result=00000000 lr=824AC578 guest_lr=82452E64 +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\73a5c0a) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000070 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000070 alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000078 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 AUDIT-HLC NtSetEvent handle=F8000078 lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000078 result=00000000 lr=824AC578 guest_lr=8245148C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000074 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000070 result=00000000 lr=824AC578 guest_lr=82452E64 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +i> F8000008 XThreadF8000070 (E) Stack: 70460000-704E0000 +i> F8000008 XThreadF8000074 (F) Stack: 70500000-70580000 +K> F8000070 XThread::Execute thid 14 (handle=F8000070, 'XThread01D4 (F8000070)', native=000001D4) +K> F8000074 XThread::Execute thid 15 (handle=F8000074, 'XThread01D8 (F8000074)', native=000001D8) +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +i> F8000008 AudioSystem::RegisterClient: driver created for index=0, driver=0x737b76010040 +i> F8000008 AudioSystem::RegisterClient: client 0 registered successfully +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000088 type=0 initial_state=0 lr=824A9F6C +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\39a9dcc) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000088 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000090 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000088 result=00000000 lr=824AC578 guest_lr=8245FA10 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000088 type=0 initial_state=0 lr=824A9F6C +F> F8000008 DiscImageDevice::ResolvePath(\dat) +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000090 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000088 alertable=0 lr=824AC578 guest_lr=82460150 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000088 result=00000000 lr=824AC578 guest_lr=82460150 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000088 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000088 alertable=0 lr=824AC578 guest_lr=82179148 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000090 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000088 result=00000000 lr=824AC578 guest_lr=82179148 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +i> F8000008 XThreadF8000088 (10) Stack: 705A0000-705B0000 +K> F8000088 XThread::Execute thid 16 (handle=F8000088, 'XThread01EC (F8000088)', native=000001EC) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000094 alertable=0 lr=824AC578 guest_lr=82173BD4 +K> F8000068 AUDIT-HLC NtSetEvent handle=F8000094 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000094 result=00000000 lr=824AC578 guest_lr=82173BD4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000098 (11) Stack: 705D0000-70650000 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000098 alertable=0 lr=824AC578 guest_lr=822F1B50 +K> F8000098 XThread::Execute thid 17 (handle=F8000098, 'XThread01F0 (F8000098)', native=000001F0) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F800009C type=1 initial_state=1 lr=824A9F6C +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000A0 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\aab216c3\5\ee70e0a) +F> F8000098 HostPathDevice::ResolvePath(\aab216c3\5) +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A0 alertable=0 lr=824AC578 guest_lr=821CBAE0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000AC alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 AUDIT-HLC NtSetEvent handle=F80000AC lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000AC result=00000000 lr=824AC578 guest_lr=8245148C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000A8 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000A0 result=00000000 lr=824AC578 guest_lr=821CBAE0 +i> F8000098 XThreadF80000A0 (12) Stack: 70670000-70680000 +K> F80000A0 XThread::Execute thid 18 (handle=F80000A0, 'XThread01F4 (F80000A0)', native=000001F4) +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +i> F80000A0 XThreadF80000A8 (13) Stack: 706A0000-706D0000 +i> F80000A0 XThreadF80000AC (14) Stack: 706F0000-70720000 +K> F80000A8 XThread::Execute thid 19 (handle=F80000A8, 'XThread01F8 (F80000A8)', native=000001F8) +K> F80000AC XThread::Execute thid 20 (handle=F80000AC, 'XThread01FC (F80000AC)', native=000001FC) +K> F80000AC AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A4 alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F80000A8 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A4 alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\c\dba806e) +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +F> F8000098 HostPathDevice::ResolvePath(\87719002\c) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\c\ec0a96e) +F> F8000098 HostPathDevice::ResolvePath(\87719002\c) +F> F80000A0 DiscImageDevice::ResolvePath(\hidden\Resource3D) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000CC type=0 initial_state=0 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000D0 type=1 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\a\60fcb85) +F> F8000098 HostPathDevice::ResolvePath(\87719002\a) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFCC8 +F> F8000098 HostPathDevice::ResolvePath(\87719002\2\85d8849) +F> F8000098 HostPathDevice::ResolvePath(\87719002\2) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\a\715f485) +F> F8000098 HostPathDevice::ResolvePath(\87719002\a) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000F8 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\c\f2a8ccd) +F> F8000098 HostPathDevice::ResolvePath(\87719002\c) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\0\1a2db9c) +F> F8000098 HostPathDevice::ResolvePath(\87719002\0) +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000EC alertable=0 lr=824AC578 guest_lr=821C515C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000B8 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000C4 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000E0 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFCC8 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFE24 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000E8 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000F4 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000EC result=00000000 lr=824AC578 guest_lr=821C515C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000100 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000098 result=00000000 lr=824AC578 guest_lr=822F1B50 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F800010C lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000B4 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFE24 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFED0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000098 (15) Stack: 705D0000-705E0000 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C4 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000098 XThread::Execute thid 21 (handle=F8000098, 'XThread0200 (F8000098)', native=00000200) +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C4 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000094 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFED0 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000094 type=1 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +i> F8000008 XThreadF80000C0 (16) Stack: 70600000-70610000 +K> F80000C0 XThread::Execute thid 22 (handle=F80000C0, 'XThread0204 (F80000C0)', native=00000204) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000C8 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C8 alertable=0 lr=824AC578 guest_lr=82172BC8 +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000C8 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C8 result=00000000 lr=824AC578 guest_lr=82172BC8 +K> F80000C0 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000094 alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +F> F80000A0 DiscImageDevice::ResolvePath(\hidden\Resource3D) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000D0 type=1 initial_state=0 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFCC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D4 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFCC8 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFE24 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D4 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFE24 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFED0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000E8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF80000D8 (17) Stack: 70630000-70640000 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F80000D8 XThread::Execute thid 23 (handle=F80000D8, 'XThread0208 (F80000D8)', native=00000208) +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000F4 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000100 (18) Stack: 70740000-707C0000 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF800010C (19) Stack: 707E0000-70860000 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000100 XThread::Execute thid 24 (handle=F8000100, 'XThread020C (F8000100)', native=0000020C) +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F800010C XThread::Execute thid 25 (handle=F800010C, 'XThread0210 (F800010C)', native=00000210) +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D4 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFED0 +F> F80000A0 DiscImageDevice::ResolvePath(\hidden\Resource3D) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000D0 type=1 initial_state=0 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFCC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D4 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFCC8 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFE24 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D4 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFE24 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFED0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D4 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFED0 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\f\ca5c62e) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000C8 type=0 initial_state=0 lr=824A9F6C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\d\14ba3f8) +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\d) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C8 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D4 type=0 initial_state=0 lr=824A9F6C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D4 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C8 result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\8\14c242d) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000C8 type=0 initial_state=0 lr=824A9F6C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\5\6324af0) +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\5) +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C8 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D4 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C8 result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\d\70a9531) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000C8 type=0 initial_state=0 lr=824A9F6C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\a\c9606f9) +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\a) +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C8 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D4 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C8 result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\7\9f2d535) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000C8 type=0 initial_state=0 lr=824A9F6C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\4\efaecd1) +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\4) +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C8 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D4 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C8 result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\7\0c3bba2) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000C8 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\4\59fbfe8) +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\4) +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C8 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D4 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C8 result=00000000 lr=824AC578 guest_lr=8245FA10 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B0 alertable=0 lr=824AC578 guest_lr=821CC19C +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000B0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B0 result=00000000 lr=824AC578 guest_lr=821CC19C +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800009C alertable=0 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800009C result=00000000 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800009C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000BC alertable=0 lr=824AC578 guest_lr=821CC19C +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000BC lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000BC result=00000000 lr=824AC578 guest_lr=821CC19C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800009C alertable=0 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800009C result=00000000 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800009C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF80000C8 (1A) Stack: 70880000-70900000 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F80000C8 XThread::Execute thid 26 (handle=F80000C8, 'XThread0214 (F80000C8)', native=00000214) +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F80000C8 AUDIT-HLC NtCreateEvent handle=F80000D0 type=1 initial_state=1 lr=824A9F6C +K> F80000C8 AUDIT-HLC NtCreateEvent handle=F80000D4 type=0 initial_state=0 lr=824A9F6C +F> F80000C8 HostPathDevice::ResolvePath(\aab216c3\5\c10eae6) +F> F80000C8 HostPathDevice::ResolvePath(\aab216c3\5) +K> F80000C8 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D4 alertable=0 lr=824AC578 guest_lr=821CBAE0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000114 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 AUDIT-HLC NtSetEvent handle=F8000114 lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000114 result=00000000 lr=824AC578 guest_lr=8245148C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000110 lr=824AA304 +K> F80000C8 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D4 result=00000000 lr=824AC578 guest_lr=821CBAE0 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +F> F8000088 DiscImageDevice::ResolvePath(\dat) +K> F8000088 AUDIT-HLC NtSetEvent handle=F8000114 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000F0 alertable=0 lr=824AC578 guest_lr=82460150 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000F0 result=00000000 lr=824AC578 guest_lr=82460150 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000BC alertable=0 lr=824AC578 guest_lr=82172BC8 +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000BC lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000BC result=00000000 lr=824AC578 guest_lr=82172BC8 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +F> F8000008 DiscImageDevice::ResolvePath(\dat\movie) +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000118 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800011C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000120 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000124 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000128 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800012C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000130 type=0 initial_state=1 lr=824A9F6C +F> F8000008 DiscImageDevice::ResolvePath(\dat\movie) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000138 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800013C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000140 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000144 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000148 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800014C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000150 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000154 type=0 initial_state=1 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +i> F8000008 XThreadF8000158 (1B) Stack: 70880000-70890000 +i> F8000008 XThreadF800015C (1C) Stack: 708B0000-708C0000 +i> F8000008 XThreadF8000160 (1D) Stack: 708E0000-708F0000 +i> F8000008 XThreadF8000164 (1E) Stack: 70910000-70920000 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25404 lr=82507ABC +K> F8000158 XThread::Execute thid 27 (handle=F8000158, 'XThread0218 (F8000158)', native=00000218) +K> F800015C XThread::Execute thid 28 (handle=F800015C, 'XThread021C (F800015C)', native=0000021C) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000160 XThread::Execute thid 29 (handle=F8000160, 'XThread0220 (F8000160)', native=00000220) +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C diff --git a/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.log.run3 b/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.log.run3 new file mode 100644 index 0000000..24192f6 --- /dev/null +++ b/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.log.run3 @@ -0,0 +1,36355 @@ +i> 000000D8 Build: canary_experimental@99fd19d02 on Jun 5 2026 +i> 000000D8 Storage root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug +i> 000000D8 ----------- CONFIG DUMP ----------- + +[APU] +apu = "any" +apu_max_queued_frames = 8 +enable_xmp = true +ffmpeg_verbose = false +mute = false +use_dedicated_xma_thread = true +xma_decoder = "new" + +[Auditing] +audit_handle_lifecycle = false +audit_jit_prolog_pc = 0 + +[CPU] +break_condition_gpr = -1 +break_condition_op = "eq" +break_condition_truncate = true +break_condition_value = 0 +break_on_debugbreak = true +break_on_instruction = 0 +break_on_start = false +break_on_unimplemented_instructions = true +clock_no_scaling = false +clock_source_raw = false +cpu = "any" +debug_symbol_loader = false +debugprint_trap_log = false +disable_context_promotion = false +disable_instruction_infocache = false +disable_prefetch_and_cachecontrol = true +disassemble_functions = false +dump_translated_hir_functions = false +elide_e0_check = false +emit_inline_mmio_checks = false +emit_mmio_aware_stores_for_recorded_exception_addresses = true +emit_source_annotations = false +enable_early_precompilation = false +full_optimization_even_with_debug = false +ignore_trap_instructions = true +ignore_undefined_externs = true +inline_loadclock = false +inline_mmio_access = true +load_module_map = "" +no_reserved_ops = false +no_round_to_single = false +permit_float_constant_evaluation = false +pvr = 7407360 +record_mmio_access_exceptions = true +store_all_context_values = false +trace_function_coverage = false +trace_function_data = false +trace_function_data_path = "" +trace_function_references = false +trace_functions = false +use_fast_dot_product = false +validate_hir = false +writable_code_segments = false + +[Config] +defaults_date = 2026040912 + +[Content] +license_mask = 0 + +[D3D12] +d3d12_adapter = -1 +d3d12_allow_variable_refresh_rate_and_tearing = true +d3d12_bindless = true +d3d12_break_on_error = false +d3d12_break_on_warning = false +d3d12_debug = false +d3d12_dxbc_disasm = false +d3d12_dxbc_disasm_dxilconv = false +d3d12_pipeline_creation_threads = -1 +d3d12_queue_priority = 1 +d3d12_submit_on_primary_buffer_end = true +d3d12_tessellation_wireframe = false + +[Display] +fullscreen = false +host_present_from_non_ui_thread = true +postprocess_antialiasing = "" +postprocess_dither = true +postprocess_ffx_cas_additional_sharpness = 0 +postprocess_ffx_fsr_max_upsampling_passes = 4 +postprocess_ffx_fsr_sharpness_reduction = 0.20000000298023224 +postprocess_scaling_and_sharpening = "" +present_letterbox = true +present_render_pass_clear = true +present_safe_area_x = 100 +present_safe_area_y = 100 + +[GPU] +anisotropic_override = -1 +async_shader_compilation = true +clear_memory_page_state = false +depth_float24_convert_in_pixel_shader = false +depth_float24_round = false +depth_transfer_not_equal_test = true +disassemble_pm4 = false +draw_resolution_scale_x = 1 +draw_resolution_scale_y = 1 +draw_resolution_scaled_texture_offsets = true +dump_shaders = "" +dxbc_source_map = false +dxbc_switch = true +execute_unclipped_draw_vs_on_cpu = true +execute_unclipped_draw_vs_on_cpu_for_psi_render_backend = true +execute_unclipped_draw_vs_on_cpu_with_scissor = false +force_convert_line_loops_to_strips = false +force_convert_quad_lists_to_triangle_lists = false +force_convert_triangle_fans_to_lists = false +framerate_limit = 0 +gamma_render_target_as_unorm16 = true +gpu = "any" +gpu_3d_to_2d_texture = true +gpu_allow_invalid_fetch_constants = true +gpu_allow_invalid_upload_range = false +half_pixel_offset = true +ignore_32bit_vertex_index_support = false +log_guest_driven_gpu_register_written_values = false +log_ringbuffer_kickoff_initiator_bts = false +mrt_edram_used_range_clamp_to_min = true +native_2x_msaa = true +native_stencil_value_output = true +native_stencil_value_output_d3d12_intel = false +no_discard_stencil_in_transfer_pipelines = false +non_seamless_cube_map = true +occlusion_query = "fast" +occlusion_query_fake_lower_threshold = 80 +occlusion_query_fake_upper_threshold = 100 +occlusion_query_querybatch_range = 0 +occlusion_query_saturation = 1 +primitive_processor_cache_min_indices = 4096 +readback_memexport = false +readback_resolve = "none" +render_target_path_d3d12 = "" +render_target_path_vulkan = "" +resolve_resolution_scale_fill_half_pixel_offset = true +snorm16_render_target_full_range = true +store_shaders = true +target_trace_file = "" +texture_cache_memory_limit_hard = 768 +texture_cache_memory_limit_render_to_texture = 24 +texture_cache_memory_limit_soft = 384 +texture_cache_memory_limit_soft_lifetime = 30 +tiled_shared_memory = true +trace_dump_path = "" +trace_gpu_prefix = "scratch/gpu/" +trace_gpu_stream = false +use_fuzzy_alpha_epsilon = false +vsync = true + +[General] +allow_game_relative_writes = false +allow_plugins = false +apply_patches = true +controller_hotkeys = false +debug = false +disable_doubleclick_fullscreen = false +discord = true +launch_module = "" +notification_sound_path = "" +priority_class = 0 +recent_titles_entry_amount = 10 +time_scalar = 1 + +[HACKS] +ac6_ground_fix = false + +[HID] +guide_button = true +hid = "any" +keyboard_mode = 0 +keyboard_user_index = 0 +left_stick_deadzone_percentage = 0 +right_stick_deadzone_percentage = 0 +vibration = true + +[HID.WinKey] +keybind_a = "0xBA" +keybind_b = "0xDE" +keybind_back = "Z" +keybind_dpad_down = "^S" +keybind_dpad_left = "^A" +keybind_dpad_right = "^D" +keybind_dpad_up = "^W" +keybind_guide = "0x08" +keybind_left_shoulder = "1" +keybind_left_thumb = "F" +keybind_left_thumb_down = "_S" +keybind_left_thumb_left = "_A" +keybind_left_thumb_right = "_D" +keybind_left_thumb_up = "_W" +keybind_left_trigger = "Q I" +keybind_right_shoulder = "3" +keybind_right_thumb = "K" +keybind_right_thumb_down = "0x28" +keybind_right_thumb_left = "0x25" +keybind_right_thumb_right = "0x27" +keybind_right_thumb_up = "0x26" +keybind_right_trigger = "E O" +keybind_start = "X" +keybind_x = "L" +keybind_y = "P" + +[Kernel] +allow_avatar_initialization = false +allow_incompatible_title_update = true +apply_title_update = true +cl = "" +console_type = 0 +default_achievements_backend = "GPD" +ignore_thread_affinities = true +ignore_thread_priorities = false +kernel_build_version = 1888 +kernel_cert_monitor = false +kernel_debug_monitor = false +kernel_display_gamma_power = 2.22222233 +kernel_display_gamma_type = 2 +kernel_pix = false +staging_mode = false + +[Logging] +enable_console = false +flush_log = true +log_file = "" +log_high_frequency_kernel_calls = false +log_level = 2 +log_mask = 0 +log_string_format_kernel_calls = false +log_to_debugprint = false +log_to_stdout = true + +[Memory] +ignore_offset_for_ranged_allocations = false +protect_on_release = false +protect_zero = true +scribble_heap = false +scribble_heap_value = 0 +writable_executable_memory = true + +[Profiles] +logged_profile_slot_0_xuid = "" +logged_profile_slot_1_xuid = "" +logged_profile_slot_2_xuid = "" +logged_profile_slot_3_xuid = "" + +[SDL] +mappings_file = "gamecontrollerdb.txt" + +[Storage] +cache_root = "" +content_root = "" +force_mount_devkit = false +mount_cache = true +mount_memory_unit = false +mount_scratch = false +storage_root = "" + +[UI] +custom_font_path = "" +font_size = 14 +headless = false +imgui_debug = false +profiler_dpi_scaling = false +show_achievement_notification = false +show_profiler = false +storage_selection_dialog = false +window_size_x = 1280 +window_size_y = 720 + +[Video] +avpack = 8 +custom_internal_display_resolution_x = 0 +custom_internal_display_resolution_y = 0 +enable_3d_mode = false +interlaced = false + +[Vulkan] +vulkan_allow_present_mode_fifo_relaxed = true +vulkan_allow_present_mode_immediate = true +vulkan_allow_present_mode_mailbox = true +vulkan_device = -1 +vulkan_log_debug_messages = true +vulkan_pipeline_creation_threads = -1 +vulkan_semaphore_reuse_workaround = false +vulkan_sparse_shared_memory = true +vulkan_validation = false + +[Win32] +win32_high_resolution_timer = true +win32_mmcss = true + +[x64] +align_all_basic_blocks = 0 +delay_via_maybeyield = false +enable_host_guest_stack_synchronization = true +enable_incorrect_roundingmode_behavior = false +enable_rmw_context_merging = false +instrument_call_times = false +max_stackpoints = 65536 +x64_extension_mask = -1 +xop_arithmetic_right_shifts = false +xop_compares = true +xop_left_shifts = false +xop_right_shifts = false +xop_rotates = false +----------- END OF CONFIG DUMP ---- +i> 000000D8 Loaded config: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\xenia-canary.config.toml +i> 000000D8 Content root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\content +i> 000000D8 Host cache root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\cache_host +w> 000000D8 Unable to load Japanese font; JP characters will be boxes +w> 000000D8 Unable to load Japanese font; JP characters will be boxes +i> 00000128 Setup: Initializing Memory... +i> 00000128 Setup: Initializing Exports... +i> 00000128 Setup: Initializing Processor... +i> 00000128 Setup: Initializing Audio... +i> 00000128 Setup: Initializing Graphics... +i> 00000128 Setup: Initializing HID... +i> 00000128 winkey: "0x08" binds key 0x8 to controller input GUIDE. +i> 00000128 winkey: "^A" binds key 0x41 to controller input DPAD_LEFT. +i> 00000128 winkey: "^D" binds key 0x44 to controller input DPAD_RIGHT. +i> 00000128 winkey: "^S" binds key 0x53 to controller input DPAD_DOWN. +i> 00000128 winkey: "^W" binds key 0x57 to controller input DPAD_UP. +i> 00000128 winkey: "_A" binds key 0x41 to controller input LEFT_THUMB_LEFT. +i> 00000128 winkey: "_D" binds key 0x44 to controller input LEFT_THUMB_RIGHT. +i> 00000128 winkey: "_S" binds key 0x53 to controller input LEFT_THUMB_DOWN. +i> 00000128 winkey: "_W" binds key 0x57 to controller input LEFT_THUMB_UP. +i> 00000128 winkey: "F" binds key 0x46 to controller input LEFT_THUMB_PRESSED. +i> 00000128 winkey: "0x26" binds key 0x26 to controller input RIGHT_THUMB_UP. +i> 00000128 winkey: "0x28" binds key 0x28 to controller input RIGHT_THUMB_DOWN. +i> 00000128 winkey: "0x27" binds key 0x27 to controller input RIGHT_THUMB_RIGHT. +i> 00000128 winkey: "0x25" binds key 0x25 to controller input RIGHT_THUMB_LEFT. +i> 00000128 winkey: "K" binds key 0x4B to controller input RIGHT_THUMB_PRESSED. +i> 00000128 winkey: "L" binds key 0x4C to controller input X. +i> 00000128 winkey: "0xDE" binds key 0xDE to controller input B. +i> 00000128 winkey: "0xBA" binds key 0xBA to controller input A. +i> 00000128 winkey: "P" binds key 0x50 to controller input Y. +i> 00000128 winkey: "Q" binds key 0x51 to controller input LEFT_TRIGGER. +i> 00000128 winkey: "I" binds key 0x49 to controller input LEFT_TRIGGER. +i> 00000128 winkey: "E" binds key 0x45 to controller input RIGHT_TRIGGER. +i> 00000128 winkey: "O" binds key 0x4F to controller input RIGHT_TRIGGER. +i> 00000128 winkey: "Z" binds key 0x5A to controller input BACK. +i> 00000128 winkey: "X" binds key 0x58 to controller input START. +i> 00000128 winkey: "1" binds key 0x31 to controller input LEFT_SHOULDER. +i> 00000128 winkey: "3" binds key 0x33 to controller input RIGHT_SHOULDER. +i> 000000D8 SDL Version 2.32.2 initialized. +w> 000000D8 SDL GameControllerDB: file 'gamecontrollerdb.txt' does not exist. +i> 00000128 Setup: Initializing VFS... +i> 00000128 PatchDB: Loaded patches for 0 titles +i> 00000128 Setup: Initializing Kernel... +i> 00000128 ProfileManager: Found 0 Profiles +w> 00000128 BaseHeap::AllocFixed attempting commit on unreserved page +w> 00000128 BaseHeap::AllocFixed attempting commit on unreserved page +i> 00000128 Setup: Starting graphics_system... +i> 00000128 DXGI adapter: NVIDIA GeForce GTX 1070 Ti (vendor 0x1002, device 0x73DF) +i> 00000128 Direct3D 12 device and OS features: +* Max GPU virtual address bits per resource: 40 +* Non-zeroed heap creation: yes +* Pixel-shader-specified stencil reference: no +* Programmable sample positions: tier 0 +* Rasterizer-ordered views: yes +* Resource binding: tier 3 +* Tiled resources: tier 4 +* Unaligned block-compressed textures: yes +i> 00000128 XThread01000010 (1) Stack: 70010000-70030000 +i> 00000128 XThread01000014 (2) Stack: 70050000-70070000 +i> 00000128 Setup: Starting audio_system... +K> 01000010 XThread::Execute thid 1 (handle=01000010, 'GPU Commands (01000010)', native=00000158, ) +K> 01000014 XThread::Execute thid 2 (handle=01000014, 'GPU Frame limiter (01000014)', native=0000015C, ) +i> 00000128 XThread01000018 (3) Stack: 70090000-700B0000 +i> 00000128 XThread0100001C (4) Stack: 700D0000-700F0000 +K> 01000018 XThread::Execute thid 3 (handle=01000018, 'XMA Decoder (01000018)', native=00000184, ) +K> 0100001C XThread::Execute thid 4 (handle=0100001C, 'Audio Worker (0100001C)', native=00000188, ) +i> 000000D8 Checking for XISO +F> 000000D8 DiscImageDevice::Initialize +i> 000000D8 Checking for XISO +F> 000000D8 DiscImageDevice::Initialize +F> 000000D8 DiscImageDevice::Initialize +i> 000000D8 Loading module GAME:\default.xex +F> 000000D8 DiscImageDevice::ResolvePath(\default.xex) +i> 000000D8 Module \Device\Cdrom0\default.xex: +Module Hash: CCF935D24A74E002 + Module Flags: 00000001 + XEX_MODULE_TITLE +Security Header: + Image Flags: 00000008 + XEX_IMAGE_XGD2_MEDIA_ONLY + Load Address: 82000000 + Image Size: 00920000 + Export Table: 00000000 +Optional Header Count: 15 + XEX_HEADER_RESOURCE_INFO: + 535107D4 828FB900-8291D8CF, 139215b + XEX_HEADER_FILE_FORMAT_INFO: + Info Size: 36 + Encryption Type: Normal + Compression Type: Normal + Window Size: 32768 + Block Size: 61440 + Block Hash: B3 2B D7 D4 EF 96 9A C5 9F D7 77 C6 8A 99 AA 1C BD 87 1C BE 00 90 2E F1 46 3F A3 D7 00 00 00 10 + XEX_HEADER_ENTRY_POINT: 824AB748 + XEX_HEADER_IMAGE_BASE_ADDRESS: 82000000 + XEX_HEADER_IMPORT_LIBRARIES: + xam.xex - 104 imports + Version: 2.0.4552.0 + Min Version: 2.0.4552.0 + xboxkrnl.exe - 294 imports + Version: 2.0.4552.0 + Min Version: 2.0.4552.0 + XEX_HEADER_CHECKSUM_TIMESTAMP: + Checksum : 00902EF1 + Time Stamp: 463FA3D7 - Tue May 8 00:10:31 2007 + XEX_HEADER_ORIGINAL_PE_NAME: default.pe + XEX_HEADER_STATIC_LIBRARIES: + XAPILIB : 2.0.3215.0 + D3D9 : 2.0.3215.1 + D3DX9 : 2.0.3215.0 + XBOXKRNL : 2.0.3215.0 + XAUD : 2.0.3215.0 + LIBCPMT : 2.0.3215.0 + XMP : 2.0.3215.0 + XMEDIA : 2.0.3215.0 + XONLINE : 2.0.3215.0 + XGRAPHC : 2.0.3215.0 + X3DAUD : 2.0.3215.1 + XACT : 2.0.3215.1 + XEX_HEADER_TLS_INFO: + Slot Count: 64 + Raw Data Address: 00000000 + Data Size: 0 + Raw Data Size: 0 + XEX_HEADER_DEFAULT_STACK_SIZE: 524288 + XEX_HEADER_SYSTEM_FLAGS: 00000400 + XEX_SYSTEM_PAL50_INCOMPATIBLE + XEX_HEADER_EXECUTION_INFO: + Media ID: 2D2E2EEB + Title ID: 535107D4 + Savegame ID: 535107D4 + Disc Number / Total: 1 / 1 + XEX_HEADER_GAME_RATINGS: + ESRB: Teen + PEGI: 12+ + PEGI-FI: 11+ + PEGI - PT: 12+ + BBFC: 12+ + CERO: Unrated + USK: Approved for children aged 12 and above + OFLC - AU: Parental Guidance + OFLC - NZ: Parental Guidance + KMRB: Unrated + Brazil: Unrated + FPB: 13+ + XEX_HEADER_LAN_KEY: E0 3C EA 47 3C AE 06 62 98 8F DB 7F 58 50 12 38 + XEX_HEADER_XBOX360_LOGO: + Section Size: 1736 + Logo Size: 1728 +Sections: + 0 RODATA 1 pages 82000000 - 82010000 (65536 bytes) + 1 RODATA 1 pages 82010000 - 82020000 (65536 bytes) + 2 RODATA 1 pages 82020000 - 82030000 (65536 bytes) + 3 RODATA 1 pages 82030000 - 82040000 (65536 bytes) + 4 RODATA 1 pages 82040000 - 82050000 (65536 bytes) + 5 RODATA 1 pages 82050000 - 82060000 (65536 bytes) + 6 RODATA 1 pages 82060000 - 82070000 (65536 bytes) + 7 RODATA 1 pages 82070000 - 82080000 (65536 bytes) + 8 RODATA 1 pages 82080000 - 82090000 (65536 bytes) + 9 RODATA 1 pages 82090000 - 820A0000 (65536 bytes) + 10 RODATA 1 pages 820A0000 - 820B0000 (65536 bytes) + 11 RODATA 1 pages 820B0000 - 820C0000 (65536 bytes) + 12 RODATA 1 pages 820C0000 - 820D0000 (65536 bytes) + 13 RODATA 1 pages 820D0000 - 820E0000 (65536 bytes) + 14 RODATA 1 pages 820E0000 - 820F0000 (65536 bytes) + 15 RODATA 1 pages 820F0000 - 82100000 (65536 bytes) + 16 RODATA 1 pages 82100000 - 82110000 (65536 bytes) + 17 RODATA 1 pages 82110000 - 82120000 (65536 bytes) + 18 RODATA 1 pages 82120000 - 82130000 (65536 bytes) + 19 RODATA 1 pages 82130000 - 82140000 (65536 bytes) + 20 RODATA 1 pages 82140000 - 82150000 (65536 bytes) + 21 CODE 1 pages 82150000 - 82160000 (65536 bytes) + 22 CODE 1 pages 82160000 - 82170000 (65536 bytes) + 23 CODE 1 pages 82170000 - 82180000 (65536 bytes) + 24 CODE 1 pages 82180000 - 82190000 (65536 bytes) + 25 CODE 1 pages 82190000 - 821A0000 (65536 bytes) + 26 CODE 1 pages 821A0000 - 821B0000 (65536 bytes) + 27 CODE 1 pages 821B0000 - 821C0000 (65536 bytes) + 28 CODE 1 pages 821C0000 - 821D0000 (65536 bytes) + 29 CODE 1 pages 821D0000 - 821E0000 (65536 bytes) + 30 CODE 1 pages 821E0000 - 821F0000 (65536 bytes) + 31 CODE 1 pages 821F0000 - 82200000 (65536 bytes) + 32 CODE 1 pages 82200000 - 82210000 (65536 bytes) + 33 CODE 1 pages 82210000 - 82220000 (65536 bytes) + 34 CODE 1 pages 82220000 - 82230000 (65536 bytes) + 35 CODE 1 pages 82230000 - 82240000 (65536 bytes) + 36 CODE 1 pages 82240000 - 82250000 (65536 bytes) + 37 CODE 1 pages 82250000 - 82260000 (65536 bytes) + 38 CODE 1 pages 82260000 - 82270000 (65536 bytes) + 39 CODE 1 pages 82270000 - 82280000 (65536 bytes) + 40 CODE 1 pages 82280000 - 82290000 (65536 bytes) + 41 CODE 1 pages 82290000 - 822A0000 (65536 bytes) + 42 CODE 1 pages 822A0000 - 822B0000 (65536 bytes) + 43 CODE 1 pages 822B0000 - 822C0000 (65536 bytes) + 44 CODE 1 pages 822C0000 - 822D0000 (65536 bytes) + 45 CODE 1 pages 822D0000 - 822E0000 (65536 bytes) + 46 CODE 1 pages 822E0000 - 822F0000 (65536 bytes) + 47 CODE 1 pages 822F0000 - 82300000 (65536 bytes) + 48 CODE 1 pages 82300000 - 82310000 (65536 bytes) + 49 CODE 1 pages 82310000 - 82320000 (65536 bytes) + 50 CODE 1 pages 82320000 - 82330000 (65536 bytes) + 51 CODE 1 pages 82330000 - 82340000 (65536 bytes) + 52 CODE 1 pages 82340000 - 82350000 (65536 bytes) + 53 CODE 1 pages 82350000 - 82360000 (65536 bytes) + 54 CODE 1 pages 82360000 - 82370000 (65536 bytes) + 55 CODE 1 pages 82370000 - 82380000 (65536 bytes) + 56 CODE 1 pages 82380000 - 82390000 (65536 bytes) + 57 CODE 1 pages 82390000 - 823A0000 (65536 bytes) + 58 CODE 1 pages 823A0000 - 823B0000 (65536 bytes) + 59 CODE 1 pages 823B0000 - 823C0000 (65536 bytes) + 60 CODE 1 pages 823C0000 - 823D0000 (65536 bytes) + 61 CODE 1 pages 823D0000 - 823E0000 (65536 bytes) + 62 CODE 1 pages 823E0000 - 823F0000 (65536 bytes) + 63 CODE 1 pages 823F0000 - 82400000 (65536 bytes) + 64 CODE 1 pages 82400000 - 82410000 (65536 bytes) + 65 CODE 1 pages 82410000 - 82420000 (65536 bytes) + 66 CODE 1 pages 82420000 - 82430000 (65536 bytes) + 67 CODE 1 pages 82430000 - 82440000 (65536 bytes) + 68 CODE 1 pages 82440000 - 82450000 (65536 bytes) + 69 CODE 1 pages 82450000 - 82460000 (65536 bytes) + 70 CODE 1 pages 82460000 - 82470000 (65536 bytes) + 71 CODE 1 pages 82470000 - 82480000 (65536 bytes) + 72 CODE 1 pages 82480000 - 82490000 (65536 bytes) + 73 CODE 1 pages 82490000 - 824A0000 (65536 bytes) + 74 CODE 1 pages 824A0000 - 824B0000 (65536 bytes) + 75 CODE 1 pages 824B0000 - 824C0000 (65536 bytes) + 76 CODE 1 pages 824C0000 - 824D0000 (65536 bytes) + 77 CODE 1 pages 824D0000 - 824E0000 (65536 bytes) + 78 CODE 1 pages 824E0000 - 824F0000 (65536 bytes) + 79 CODE 1 pages 824F0000 - 82500000 (65536 bytes) + 80 CODE 1 pages 82500000 - 82510000 (65536 bytes) + 81 CODE 1 pages 82510000 - 82520000 (65536 bytes) + 82 CODE 1 pages 82520000 - 82530000 (65536 bytes) + 83 CODE 1 pages 82530000 - 82540000 (65536 bytes) + 84 CODE 1 pages 82540000 - 82550000 (65536 bytes) + 85 CODE 1 pages 82550000 - 82560000 (65536 bytes) + 86 CODE 1 pages 82560000 - 82570000 (65536 bytes) + 87 CODE 1 pages 82570000 - 82580000 (65536 bytes) + 88 CODE 1 pages 82580000 - 82590000 (65536 bytes) + 89 CODE 1 pages 82590000 - 825A0000 (65536 bytes) + 90 CODE 1 pages 825A0000 - 825B0000 (65536 bytes) + 91 CODE 1 pages 825B0000 - 825C0000 (65536 bytes) + 92 CODE 1 pages 825C0000 - 825D0000 (65536 bytes) + 93 CODE 1 pages 825D0000 - 825E0000 (65536 bytes) + 94 CODE 1 pages 825E0000 - 825F0000 (65536 bytes) + 95 CODE 1 pages 825F0000 - 82600000 (65536 bytes) + 96 CODE 1 pages 82600000 - 82610000 (65536 bytes) + 97 CODE 1 pages 82610000 - 82620000 (65536 bytes) + 98 CODE 1 pages 82620000 - 82630000 (65536 bytes) + 99 CODE 1 pages 82630000 - 82640000 (65536 bytes) + 100 CODE 1 pages 82640000 - 82650000 (65536 bytes) + 101 CODE 1 pages 82650000 - 82660000 (65536 bytes) + 102 CODE 1 pages 82660000 - 82670000 (65536 bytes) + 103 CODE 1 pages 82670000 - 82680000 (65536 bytes) + 104 CODE 1 pages 82680000 - 82690000 (65536 bytes) + 105 CODE 1 pages 82690000 - 826A0000 (65536 bytes) + 106 CODE 1 pages 826A0000 - 826B0000 (65536 bytes) + 107 CODE 1 pages 826B0000 - 826C0000 (65536 bytes) + 108 CODE 1 pages 826C0000 - 826D0000 (65536 bytes) + 109 CODE 1 pages 826D0000 - 826E0000 (65536 bytes) + 110 CODE 1 pages 826E0000 - 826F0000 (65536 bytes) + 111 CODE 1 pages 826F0000 - 82700000 (65536 bytes) + 112 CODE 1 pages 82700000 - 82710000 (65536 bytes) + 113 CODE 1 pages 82710000 - 82720000 (65536 bytes) + 114 CODE 1 pages 82720000 - 82730000 (65536 bytes) + 115 CODE 1 pages 82730000 - 82740000 (65536 bytes) + 116 CODE 1 pages 82740000 - 82750000 (65536 bytes) + 117 CODE 1 pages 82750000 - 82760000 (65536 bytes) + 118 CODE 1 pages 82760000 - 82770000 (65536 bytes) + 119 CODE 1 pages 82770000 - 82780000 (65536 bytes) + 120 CODE 1 pages 82780000 - 82790000 (65536 bytes) + 121 CODE 1 pages 82790000 - 827A0000 (65536 bytes) + 122 CODE 1 pages 827A0000 - 827B0000 (65536 bytes) + 123 CODE 1 pages 827B0000 - 827C0000 (65536 bytes) + 124 CODE 1 pages 827C0000 - 827D0000 (65536 bytes) + 125 CODE 1 pages 827D0000 - 827E0000 (65536 bytes) + 126 CODE 1 pages 827E0000 - 827F0000 (65536 bytes) + 127 CODE 1 pages 827F0000 - 82800000 (65536 bytes) + 128 CODE 1 pages 82800000 - 82810000 (65536 bytes) + 129 CODE 1 pages 82810000 - 82820000 (65536 bytes) + 130 CODE 1 pages 82820000 - 82830000 (65536 bytes) + 131 CODE 1 pages 82830000 - 82840000 (65536 bytes) + 132 CODE 1 pages 82840000 - 82850000 (65536 bytes) + 133 CODE 1 pages 82850000 - 82860000 (65536 bytes) + 134 CODE 1 pages 82860000 - 82870000 (65536 bytes) + 135 RWDATA 1 pages 82870000 - 82880000 (65536 bytes) + 136 RWDATA 1 pages 82880000 - 82890000 (65536 bytes) + 137 RWDATA 1 pages 82890000 - 828A0000 (65536 bytes) + 138 RWDATA 1 pages 828A0000 - 828B0000 (65536 bytes) + 139 RWDATA 1 pages 828B0000 - 828C0000 (65536 bytes) + 140 RWDATA 1 pages 828C0000 - 828D0000 (65536 bytes) + 141 RWDATA 1 pages 828D0000 - 828E0000 (65536 bytes) + 142 RWDATA 1 pages 828E0000 - 828F0000 (65536 bytes) + 143 RWDATA 1 pages 828F0000 - 82900000 (65536 bytes) + 144 RWDATA 1 pages 82900000 - 82910000 (65536 bytes) + 145 RWDATA 1 pages 82910000 - 82920000 (65536 bytes) +Imports: + xam - 52 imports + Version: 0.0.4552.32 + Min Version: 0.0.4552.32 + + Total: 52 + Known: 100% (52 known, 0 unknown) + Implemented: 98% (51 implemented, 1 unimplemented) + + F 82000600 8284DA7C 28C ( 652) XNotifyPositionUI + F 82000604 8284DA8C 2BC ( 700) XamShowSigninUI + F 82000608 8284DA9C 2C1 ( 705) XamShowKeyboardUI + F 8200060C 8284DAAC 2D5 ( 725) !! XamShowGamerCardUIForXUID + F 82000610 8284DABC 2CB ( 715) XamShowDeviceSelectorUI + F 82000614 8284DACC 2D9 ( 729) XamShowDirtyDiscErrorUI + F 82000618 8284DADC 1B3 ( 435) XamTaskShouldExit + F 8200061C 8284DAEC 1B1 ( 433) XamTaskCloseHandle + F 82000620 8284DAFC 1AF ( 431) XamTaskSchedule + F 82000624 8284DB0C 1A4 ( 420) XamLoaderLaunchTitle + F 82000628 8284DB1C 1F7 ( 503) XMsgStartIORequest + F 8200062C 8284DB2C 20E ( 526) XamUserGetName + F 82000630 8284DB3C 210 ( 528) XamUserGetSigninState + F 82000634 8284DB4C 282 ( 642) XamGetSystemVersion + F 82000638 8284DB5C 2F7 ( 759) XamUserCreateStatsEnumerator + F 8200063C 8284DB6C 2EE ( 750) XamUserCreateAchievementEnumerator + F 82000640 8284DB7C 20A ( 522) XamUserGetXUID + F 82000644 8284DB8C 250 ( 592) XamEnumerate + F 82000648 8284DB9C 3CC ( 972) XGetGameRegion + F 8200064C 8284DBAC 190 ( 400) XamInputGetCapabilities + F 82000650 8284DBBC 191 ( 401) XamInputGetState + F 82000654 8284DBCC 192 ( 402) XamInputSetState + F 82000658 8284DBDC 198 ( 408) XamInputGetKeystrokeEx + F 8200065C 8284DBEC 258 ( 600) XamContentCreate + F 82000660 8284DBFC 25B ( 603) XamContentDelete + F 82000664 8284DC0C 25A ( 602) XamContentClose + F 82000668 8284DC1C 260 ( 608) XamContentSetThumbnail + F 8200066C 8284DC2C 262 ( 610) XamContentGetCreator + F 82000670 8284DC3C 25C ( 604) XamContentCreateEnumerator + F 82000674 8284DC4C 265 ( 613) XamContentGetDeviceState + F 82000678 8284DC5C 25E ( 606) XamContentGetDeviceData + F 8200067C 8284DC6C 25F ( 607) XamContentGetDeviceName + F 82000680 8284DC7C 1A0 ( 416) XamEnableInactivityProcessing + F 82000684 8284DC8C 1A1 ( 417) XamResetInactivity + F 82000688 8284DC9C 2DC ( 732) XamShowMessageBoxUIEx + F 8200068C 8284DCAC 3CD ( 973) XGetLanguage + F 82000690 8284DCBC 3CB ( 971) XGetAVPack + F 82000694 8284DCCC 1A9 ( 425) XamLoaderTerminateTitle + F 82000698 8284DCDC 280 ( 640) XamGetExecutionId + F 8200069C 8284E45C 28B ( 651) XNotifyGetNext + F 820006A0 8284E44C 002 ( 2) NetDll_WSACleanup + F 820006A4 8284E43C 001 ( 1) NetDll_WSAStartup + F 820006A8 8284E46C 28A ( 650) XamNotifyCreateListener + F 820006AC 8284E42C 316 ( 790) XamSessionCreateHandle + F 820006B0 8284E41C 317 ( 791) XamSessionRefObjByHandle + F 820006B4 8284E40C 21A ( 538) XamUserWriteProfileSettings + F 820006B8 8284E3FC 219 ( 537) XamUserReadProfileSettings + F 820006BC 8284E3EC 1EA ( 490) XamAlloc + F 820006C0 8284E3DC 1EC ( 492) XamFree + F 820006C4 8284E3CC 3D1 ( 977) XGetVideoMode + F 820006C8 8284E3BC 1F4 ( 500) XMsgInProcessCall + F 820006CC 8284E3AC 1FC ( 508) XMsgStartIORequestEx + + xboxkrnl - 152 imports + Version: 0.0.4552.32 + Min Version: 0.0.4552.32 + + Total: 152 + Known: 100% (152 known, 0 unknown) + Implemented: 95% (145 implemented, 7 unimplemented) + + F 820006D4 8284E1FC 0B4 ( 180) KfReleaseSpinLock + F 820006D8 8284E20C 0B1 ( 177) KfAcquireSpinLock + F 820006DC 8284E21C 1DF ( 479) KiApcNormalRoutineNop + F 820006E0 8284E22C 1B6 ( 438) VdEnableRingBufferRPtrWriteBack + F 820006E4 8284E23C 1C3 ( 451) VdInitializeRingBuffer + F 820006E8 8284E24C 0BE ( 190) MmGetPhysicalAddress + F 820006EC 8284E25C 1D9 ( 473) VdSetSystemCommandBufferGpuIdentifierAddress + F 820006F0 8284E26C 13B ( 315) sprintf + F 820006F4 8284E27C 1B9 ( 441) VdGetCurrentDisplayGamma + V 820006F8 266 ( 614) KeCertMonitorData + F 820006FC 8284E28C 14D ( 333) _vsnprintf + V 82000700 158 ( 344) XboxKrnlVersion + F 82000704 8284E29C 1DC ( 476) VdShutdownEngines + F 82000708 8284E2AC 1CA ( 458) VdQueryVideoMode + F 8200070C 8284E2BC 1BA ( 442) VdGetCurrentDisplayInformation + F 82000710 8284E2CC 1D3 ( 467) VdSetDisplayMode + F 82000714 8284E2DC 1D5 ( 469) VdSetGraphicsInterruptCallback + F 82000718 8284E2EC 1C2 ( 450) VdInitializeEngines + F 8200071C 8284E2FC 1C6 ( 454) VdIsHSIOTrainingSucceeded + F 82000720 8284E30C 1C9 ( 457) VdQueryVideoFlags + F 82000724 8284E31C 1B1 ( 433) VdCallGraphicsNotificationRoutines + V 82000728 1C0 ( 448) VdGpuClockInMHz + F 8200072C 8284E32C 1C5 ( 453) VdInitializeScalerCommandBuffer + F 82000730 8284E33C 269 ( 617) VdRetrainEDRAM + F 82000734 8284E34C 26A ( 618) VdRetrainEDRAMWorker + V 82000738 1C1 ( 449) VdHSIOCalibrationLock + F 8200073C 8284E35C 06B ( 107) KeLockL2 + F 82000740 8284E36C 06C ( 108) KeUnlockL2 + F 82000744 8284E37C 1C7 ( 455) VdPersistDisplay + F 82000748 8284E38C 25B ( 603) VdSwap + F 8200074C 8284E39C 1BD ( 445) VdGetSystemCommandBuffer + V 82000750 1BE ( 446) VdGlobalDevice + F 82000754 8284E1EC 04D ( 77) KeAcquireSpinLockAtRaisedIrql + F 82000758 8284E1DC 089 ( 137) KeReleaseSpinLockFromRaisedIrql + F 8200075C 8284E1CC 1B4 ( 436) VdEnableDisableClockGating + F 82000760 8284E1BC 13F ( 319) RtlTimeFieldsToTime + F 82000764 8284E1AC 136 ( 310) RtlRaiseException + F 82000768 8284E19C 0EE ( 238) NtQueryVirtualMemory + F 8200076C 8284E18C 11B ( 283) RtlCompareMemoryUlong + F 82000770 8284E17C 066 ( 102) KeGetCurrentProcessType + F 82000774 8284E16C 053 ( 83) KeBugCheckEx + F 82000778 8284E15C 126 ( 294) RtlFillMemoryUlong + V 8200077C 1AE ( 430) ExLoadedCommandLine + F 82000780 8284E14C 05A ( 90) KeDelayExecutionThread + F 82000784 8284E13C 143 ( 323) RtlUnicodeToMultiByteN + F 82000788 8284E12C 0E4 ( 228) NtQueryDirectoryFile + F 8200078C 8284E10C 019 ( 25) ExTerminateThread + F 82000790 8284E0FC 09B ( 155) KeSetCurrentStackPointers + F 82000794 8284E0EC 197 ( 407) XexGetProcedureAddress + F 82000798 8284E0DC 03C ( 60) !! IoDismountVolumeByFileHandle + F 8200079C 8284E0CC 0D9 ( 217) NtDeviceIoControlFile + F 820007A0 8284E0BC 028 ( 40) HalReturnToFirmware + F 820007A4 8284E0AC 003 ( 3) DbgPrint + F 820007A8 8284E09C 140 ( 320) RtlTimeToTimeFields + F 820007AC 8284E08C 0FE ( 254) NtWaitForMultipleObjectsEx + F 820007B0 8284E07C 0F3 ( 243) NtReleaseSemaphore + F 820007B4 8284E06C 0D5 ( 213) NtCreateSemaphore + F 820007B8 8284E05C 084 ( 132) KeQuerySystemTime + F 820007BC 8284E04C 0E8 ( 232) NtQueryInformationFile + F 820007C0 8284E03C 0F7 ( 247) NtSetInformationFile + F 820007C4 8284E02C 0FD ( 253) NtWaitForSingleObjectEx + F 820007C8 8284E01C 0CE ( 206) NtClearEvent + F 820007CC 8284E00C 0F5 ( 245) NtResumeThread + V 820007D0 0AD ( 173) KeTimeStampBundle + F 820007D4 8284DFFC 010 ( 16) ExGetXConfigSetting + V 820007D8 059 ( 89) KeDebugMonitorData + F 820007DC 8284DFEC 097 ( 151) KeSetAffinityThread + F 820007E0 8284DFDC 0FC ( 252) NtSuspendThread + F 820007E4 8284DFCC 081 ( 129) KeQueryBasePriorityThread + V 820007E8 01B ( 27) ExThreadObjectType + F 820007EC 8284DFBC 110 ( 272) ObReferenceObjectByHandle + F 820007F0 8284DFAC 099 ( 153) KeSetBasePriorityThread + F 820007F4 8284DF9C 10B ( 267) ObLookupThreadByThreadId + F 820007F8 8284DF8C 10E ( 270) ObOpenObjectByPointer + F 820007FC 8284DF7C 0DA ( 218) NtDuplicateObject + F 82000800 8284DF6C 101 ( 257) NtYieldExecution + F 82000804 8284DF5C 0F6 ( 246) NtSetEvent + F 82000808 8284DF4C 052 ( 82) KeBugCheck + F 8200080C 8284DF3C 0BC ( 188) MmDeleteKernelStack + F 82000810 8284DF2C 0BB ( 187) MmCreateKernelStack + F 82000814 8284DF1C 0D1 ( 209) NtCreateEvent + F 82000818 8284DF0C 135 ( 309) RtlNtStatusToDosError + F 8200081C 8284DEFC 194 ( 404) XexCheckExecutablePrivilege + F 82000820 8284DEEC 05F ( 95) KeEnterCriticalRegion + F 82000824 8284DEDC 07D ( 125) KeLeaveCriticalRegion + F 82000828 8284DECC 0CC ( 204) NtAllocateVirtualMemory + F 8200082C 8284DEBC 259 ( 601) !! StfsCreateDevice + F 82000830 8284DEAC 103 ( 259) ObCreateSymbolicLink + F 82000834 8284DE9C 25A ( 602) !! StfsControlDevice + F 82000838 8284DE8C 0DB ( 219) NtFlushBuffersFile + F 8200083C 8284DE7C 104 ( 260) ObDeleteSymbolicLink + F 82000840 8284DE6C 105 ( 261) ObDereferenceObject + F 82000844 8284DE5C 0DC ( 220) NtFreeVirtualMemory + F 82000848 8284DE4C 0D2 ( 210) NtCreateFile + F 8200084C 8284DE3C 256 ( 598) XeKeysConsolePrivateKeySign + F 82000850 8284DE2C 0F0 ( 240) NtReadFile + F 82000854 8284DE1C 0FF ( 255) NtWriteFile + F 82000858 8284DE0C 192 ( 402) XeCryptSha + F 8200085C 8284DDFC 257 ( 599) !! XeKeysConsoleSignatureVerification + F 82000860 8284DDEC 015 ( 21) ExRegisterTitleTerminateNotification + F 82000864 8284DDDC 09D ( 157) KeSetEvent + F 82000868 8284DDCC 0B0 ( 176) KeWaitForSingleObject + F 8200086C 8284DDBC 08F ( 143) KeResetEvent + V 82000870 193 ( 403) XexExecutableModuleHandle + F 82000874 8284DDAC 12B ( 299) RtlImageXexHeaderField + F 82000878 8284DD9C 1A5 ( 421) !! __C_specific_handler + F 8200087C 8284DD8C 12C ( 300) RtlInitAnsiString + F 82000880 8284DD7C 0DF ( 223) NtOpenFile + F 82000884 8284DD6C 0CF ( 207) NtClose + F 82000888 8284DD5C 0EF ( 239) NtQueryVolumeInformationFile + F 8200088C 8284DD4C 0C4 ( 196) MmQueryAddressProtect + F 82000890 8284DD3C 0BD ( 189) MmFreePhysicalMemory + F 82000894 8284DD2C 0BA ( 186) MmAllocatePhysicalMemoryEx + F 82000898 8284DD1C 12E ( 302) RtlInitializeCriticalSection + F 8200089C 8284DD0C 130 ( 304) RtlLeaveCriticalSection + F 820008A0 8284DCFC 125 ( 293) RtlEnterCriticalSection + F 820008A4 8284DCEC 12F ( 303) RtlInitializeCriticalSectionAndSpinCount + F 820008A8 8284E11C 00D ( 13) ExCreateThread + F 820008AC 8284E47C 085 ( 133) KeRaiseIrqlToDpcLevel + F 820008B0 8284E48C 0B3 ( 179) KfLowerIrql + F 820008B4 8284E49C 088 ( 136) KeReleaseSemaphore + F 820008B8 8284E4AC 1F8 ( 504) XAudioGetVoiceCategoryVolume + F 820008BC 8284E4BC 1F7 ( 503) XAudioGetVoiceCategoryVolumeChangeMask + F 820008C0 8284E4CC 0AF ( 175) KeWaitForMultipleObjects + F 820008C4 8284E4DC 092 ( 146) KeResumeThread + F 820008C8 8284E4EC 074 ( 116) KeInitializeSemaphore + F 820008CC 8284E4FC 226 ( 550) XMAReleaseContext + F 820008D0 8284E50C 224 ( 548) XMACreateContext + F 820008D4 8284E51C 083 ( 131) KeQueryPerformanceFrequency + F 820008D8 8284E52C 141 ( 321) RtlTryEnterCriticalSection + F 820008DC 8284E53C 0AE ( 174) KeTryToAcquireSpinLockAtRaisedIrql + F 820008E0 8284E54C 1F3 ( 499) XAudioRegisterRenderDriverClient + F 820008E4 8284E55C 1F4 ( 500) XAudioUnregisterRenderDriverClient + F 820008E8 8284E56C 1F5 ( 501) XAudioSubmitRenderDriverFrame + F 820008EC 8284E57C 195 ( 405) XexGetModuleHandle + F 820008F0 8284E58C 147 ( 327) !! RtlUnwind + F 820008F4 8284E59C 152 ( 338) KeTlsAlloc + F 820008F8 8284E5AC 154 ( 340) KeTlsGetValue + F 820008FC 8284E5BC 155 ( 341) KeTlsSetValue + F 82000900 8284E5CC 153 ( 339) KeTlsFree + F 82000904 8284E5DC 119 ( 281) !! RtlCaptureContext + F 82000908 8284E5EC 05D ( 93) KeEnableFpuExceptions + F 8200090C 8284E5FC 0C6 ( 198) MmQueryStatistics + F 82000910 8284E60C 0D7 ( 215) NtCreateTimer + F 82000914 8284E61C 0FA ( 250) NtSetTimerEx + F 82000918 8284E62C 0CD ( 205) NtCancelTimer + F 8200091C 8284E63C 0E7 ( 231) NtQueryFullAttributesFile + F 82000920 8284E64C 127 ( 295) RtlFreeAnsiString + F 82000924 8284E65C 142 ( 322) RtlUnicodeStringToAnsiString + F 82000928 8284E66C 12D ( 301) RtlInitUnicodeString + F 8200092C 8284E67C 133 ( 307) RtlMultiByteToUnicodeN + F 82000930 8284E68C 001 ( 1) DbgBreakPoint + +w> 000000D8 GameDatabase: Title doesn't contain XLAST data! Multiplayer functionality might be limited. +i> 000000D8 Title name: PROJECT SYLPHEED +i> 000000D8 +-------------------- ACHIEVEMENTS -------------------- ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| ID | Title | Description | Type | Gamerscore | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 1 | Space Combat Award | Received after your first space battle in the Glasner Training Area. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 2 | Schlos Base Defense Award | Received for stopping the missile attack on Schlos Base. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 3 | Aegis of the People Medal | Received for escorting all 7 refugee ships to safety. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 4 | TCAF Luna Medal | Received for bravely helping the fleet escape during the invasion of the Matisse System. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 5 | TCAF Mars Medal | Received for bravery beyond the call of duty during the escape from the Matisse System. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 6 | Soldier's Charm Amulet | Given to you by Raymond as a token of his trust. | Event | 50 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 7 | White Griffons Patch | Received by the commander and pilots of the White Griffon Squadron when it is formed. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 8 | TCAF Jupiter Medal | Received for bravery during the enemy's attack on the Alberti System. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 9 | Furious Pursuit Badge | Received for continuing attacks on the enemy and shooting down a large number of ships. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 10 | Solo Aerospace Combat Award | Received for descending into Acheron's atmosphere and engaging in combat alone. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 11 | Operation Nebula Blaze Award | Received for completing the extremely hazardous Operation Nebula Blaze. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 12 | Guilty Roses Patch | Received for repelling the Guilty Roses Squadron. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 13 | Super Battleship Slayer Patch | Received for shooting down the second S battleship. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 14 | TCAF Terra Medal | Received for shielding the fleet and seeing that all ships safely fled the Ingres System. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 15 | Hellfires Patch | Received for repelling the enemy Hellfire Squadron. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 16 | Night Ravens Patch | Received for challenging and eradicating the Night Raven Squadron. | Event | 50 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 17 | Solar System Defense Award | Received for great achievements during the campaign to defend the Solar System. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 18 | Special Operations Medal | Received for heroically destroying the Prometheus Driver. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 19 | 1,000 Units Destroyed Medal | Received for shooting down 1,000 enemy fighters and attackers in combat. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 20 | 10,000 Units Destroyed Medal | Received for shooting down 10,000 enemy fighters and attackers in combat. | Event | 70 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 21 | Ship Hunter Award | Received for shooting down 100 enemy warships in combat. | Event | 50 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 22 | Gigaton Club Patch | Received for shooting down enemy vessels with a total weight of one gigaton. | Event | 70 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 23 | Weapon Lord Patch | Received after you collect all usable equipment for the Delta Saber. | Event | 80 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 24 | TCAF Pilot's Commendation | Commemmorates you as one of the greatest pilots in history. | Event | 100 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +i> 000000D8 +-------------------- PROPERTIES -------------------- ++----------+------------------+-------------+-----------+ +| ID | Name | Matchmaking | Data Size | ++----------+------------------+-------------+-----------+ +| 10000006 | Killed Aircrafts | False | 4 | ++----------+------------------+-------------+-----------+ +| 10000008 | Equipments | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000000A | Clear Time | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000000B | Killed Warships | False | 4 | ++----------+------------------+-------------+-----------+ +| 10008001 | Rank | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000800A | | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000800B | | False | 4 | ++----------+------------------+-------------+-----------+ +| 20000005 | Killed Weight | False | 8 | ++----------+------------------+-------------+-----------+ +| 20000007 | Clear Time | False | 8 | ++----------+------------------+-------------+-----------+ +| 20000009 | Earned Points | False | 8 | ++----------+------------------+-------------+-----------+ +| 40008002 | Gamer Name | False | 2 | ++----------+------------------+-------------+-----------+ +i> 000000D8 +-------------------- CONTEXTS -------------------- ++----------+-------------+-------------+---------------+-----------+ +| ID | Name | Matchmaking | Default Value | Max Value | ++----------+-------------+-------------+---------------+-----------+ +| 00000000 | Game Stage | False | 0 | 28 | ++----------+-------------+-------------+---------------+-----------+ +| 00000001 | Game Status | False | 0 | 9 | ++----------+-------------+-------------+---------------+-----------+ +| 00008001 | | False | 0 | 0 | ++----------+-------------+-------------+---------------+-----------+ +| 0000800A | Game Type | True | 0 | 1 | ++----------+-------------+-------------+---------------+-----------+ +| 0000800B | | True | 0 | 0 | ++----------+-------------+-------------+---------------+-----------+ +i> 000000D8 +-------------------- STATS VIEWS -------------------- ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| ID | View Type | Name | Skilled | Arbitrated | Hidden | Team View | Online Only | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000001 | Leaderboard | Time Attack (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000002 | Leaderboard | Score Attack (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000003 | Leaderboard | Extra 1 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000004 | Leaderboard | Extra 1 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000005 | Leaderboard | Extra 2 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000006 | Leaderboard | Extra 2 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000007 | Leaderboard | Extra 3 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000008 | Leaderboard | Extra 3 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000009 | Leaderboard | Extra 4 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 0000000A | Leaderboard | Extra 4 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 0000000C | Leaderboard | Time Attack (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 0000000D | Leaderboard | Score Attack (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| FFFF0000 | Leaderboard | | True | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +i> 000000D8 +-------------------- PRESENCE MODES -------------------- ++---------------+----------------+------------------+ +| Context Value | Contexts Count | Properties Count | ++---------------+----------------+------------------+ +| 0 | 2 | 0 | ++---------------+----------------+------------------+ +i> 000000D8 XThread01000020 (5) Stack: 70110000-70130000 +i> 000000D8 KernelState: Launching module... +i> 01000010 Loaded 7 shaders from storage +i> 01000010 Loaded 4 pipeline descriptions, 8 shader translations needed +i> 000000D8 XThreadF8000008 (6) Stack: 70150000-701D0000 +K> 01000020 XThread::Execute thid 5 (handle=01000020, 'Kernel Dispatch (01000020)', native=00000194, ) +K> F8000008 XThread::Execute thid 6 (handle=F8000008, 'Main XThread (F8000008)', native=0000019C) +i> 01000010 Translated 7 shaders in 3 ms +i> 01000010 Pipeline cache loaded: 4 created, 0 already exist, 4 total stored +i> 01000010 Pipeline creation took 0 milliseconds +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800000C type=1 initial_state=0 lr=824A9F6C +F> F8000008 NullDevice::ResolvePath() +F> F8000008 NullDevice::ResolvePath() +F> F8000008 NullDevice::ResolvePath() +!> F8000008 undefined extern call to 8284E0DC IoDismountVolumeByFileHandle +F> F8000008 NullDevice::ResolvePath() +i> F8000008 Got xam task args: v1 = 02080002, v2 = 00000000 +i> F8000008 XThreadF8000010 (7) Stack: 701F0000-70270000 +K> F8000010 XThread::Execute thid 7 (handle=F8000010, 'XThread01BC (F8000010)', native=000001BC) +F> F8000010 NullDevice::ResolvePath() +w> F8000010 Game is attempting to allocate devkit debug memory (base: 00000000, size: 000FF000). Ignoring debug flag and using normal allocation. +!> F8000010 undefined extern call to 8284DEBC StfsCreateDevice +K> F8000010 AUDIT-HLC KeSetEvent guest_ptr=8287094C lr=824A95D0 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000020 type=1 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000024 (8) Stack: 70290000-702B0000 +K> F8000024 XThread::Execute thid 8 (handle=F8000024, 'XThread01C0 (F8000024)', native=000001C0) +K> F8000024 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000020 alertable=0 lr=824AC578 guest_lr=824AFFC4 +F> F8000008 HostPathDevice::ResolvePath() +i> F8000008 XThreadF800002C (9) Stack: 702D0000-702E0000 +K> F800002C XThread::Execute thid 9 (handle=F800002C, 'XThread01C4 (F800002C)', native=000001C4) +F> F800002C HostPathDevice::ResolvePath() +F> F800002C HostPathDevice::ResolvePath() +F> F8000008 HostPathDevice::ResolvePath(\d4ea4615\e\46ee8ca) +F> F8000008 HostPathDevice::ResolvePath(\d4ea4615\e) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800003C type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000040 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000048 (A) Stack: 70300000-70340000 +K> F8000048 XThread::Execute thid 10 (handle=F8000048, 'XThread01C8 (F8000048)', native=000001C8) +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800003C alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000050 type=0 initial_state=0 lr=824A9F6C +!> F800002C BaseHeap::Release failed because address is not a region start +!> F800002C PhysicalHeap::Release failed due to parent heap failure +F> F800002C HostPathDevice::ResolvePath() +F> F800002C HostPathDevice::ResolvePath() +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F800004C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800003C result=00000000 lr=824AC578 guest_lr=82452E64 +!> F800002C BaseHeap::Release failed because address is not a region start +!> F800002C PhysicalHeap::Release failed due to parent heap failure +K> F800002C AUDIT-HLC NtWaitForSingleObjectEx handle=F8000028 alertable=0 lr=824AC578 guest_lr=824AFFC4 +!> F8000008 BaseHeap::Release failed because address is not a region start +!> F8000008 PhysicalHeap::Release failed due to parent heap failure +!> F8000008 BaseHeap::Release failed because address is not a region start +!> F8000008 PhysicalHeap::Release failed due to parent heap failure +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\8\3421153) +F> F8000008 DiscImageDevice::ResolvePath(\dat) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\355f2f8) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000038 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800004C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800004C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000050 type=0 initial_state=0 lr=824A9F6C +i> F8000048 XThreadF8000058 (B) Stack: 70360000-70370000 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F800004C alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 XThread::Execute thid 11 (handle=F8000058, 'XThread01CC (F8000058)', native=000001CC) +K> F8000058 AUDIT-HLC NtSetEvent handle=F800004C lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800004C result=00000000 lr=824AC578 guest_lr=8245148C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F800003C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=82452E64 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000038 type=1 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF800004C (C) Stack: 70390000-703A0000 +K> F800004C XThread::Execute thid 12 (handle=F800004C, 'XThread01D0 (F800004C)', native=000001D0) +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +i> F8000008 Hardware scaler: width ratio 1:1, height ratio 1:1, final aspect ratio 16:9 +i> 01000010 Selecting rep movs vastcpy. +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000060 type=1 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000064 type=1 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000068 (D) Stack: 703C0000-70440000 +K> F8000068 XThread::Execute thid 13 (handle=F8000068, 'XThread01D4 (F8000068)', native=000001D4) +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +F> F8000008 HostPathDevice::ResolvePath(\aab216c3\a\2c8c185) +F> F8000008 HostPathDevice::ResolvePath(\aab216c3\a) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000070 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000070 alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000078 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 AUDIT-HLC NtSetEvent handle=F8000078 lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000078 result=00000000 lr=824AC578 guest_lr=8245148C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000074 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000070 result=00000000 lr=824AC578 guest_lr=82452E64 +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\73a5c0a) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000070 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000070 alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000078 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 AUDIT-HLC NtSetEvent handle=F8000078 lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000078 result=00000000 lr=824AC578 guest_lr=8245148C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000074 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000070 result=00000000 lr=824AC578 guest_lr=82452E64 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +i> F8000008 XThreadF8000070 (E) Stack: 70460000-704E0000 +i> F8000008 XThreadF8000074 (F) Stack: 70500000-70580000 +K> F8000070 XThread::Execute thid 14 (handle=F8000070, 'XThread01D8 (F8000070)', native=000001D8) +K> F8000074 XThread::Execute thid 15 (handle=F8000074, 'XThread01DC (F8000074)', native=000001DC) +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +i> F8000008 AudioSystem::RegisterClient: driver created for index=0, driver=0x7e36a2010040 +i> F8000008 AudioSystem::RegisterClient: client 0 registered successfully +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\39a9dcc) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800008C alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000094 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800008C result=00000000 lr=824AC578 guest_lr=8245FA10 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +F> F8000008 DiscImageDevice::ResolvePath(\dat) +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000094 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800008C alertable=0 lr=824AC578 guest_lr=82460150 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800008C result=00000000 lr=824AC578 guest_lr=82460150 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800008C alertable=0 lr=824AC578 guest_lr=82179148 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000094 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800008C result=00000000 lr=824AC578 guest_lr=82179148 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +i> F8000008 XThreadF800008C (10) Stack: 705A0000-705B0000 +K> F800008C XThread::Execute thid 16 (handle=F800008C, 'XThread01F0 (F800008C)', native=000001F0) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000094 alertable=0 lr=824AC578 guest_lr=82173BD4 +K> F8000068 AUDIT-HLC NtSetEvent handle=F8000094 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000094 result=00000000 lr=824AC578 guest_lr=82173BD4 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000098 (11) Stack: 705D0000-70650000 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000098 alertable=0 lr=824AC578 guest_lr=822F1B50 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000098 XThread::Execute thid 17 (handle=F8000098, 'XThread01F4 (F8000098)', native=000001F4) +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000098 AUDIT-HLC NtCreateEvent handle=F800009C type=1 initial_state=1 lr=824A9F6C +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000A0 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\aab216c3\5\ee70e0a) +F> F8000098 HostPathDevice::ResolvePath(\aab216c3\5) +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A0 alertable=0 lr=824AC578 guest_lr=821CBAE0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000AC alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 AUDIT-HLC NtSetEvent handle=F80000AC lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000AC result=00000000 lr=824AC578 guest_lr=8245148C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000A8 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000A0 result=00000000 lr=824AC578 guest_lr=821CBAE0 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +i> F8000098 XThreadF80000A0 (12) Stack: 70670000-70680000 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F80000A0 XThread::Execute thid 18 (handle=F80000A0, 'XThread01F8 (F80000A0)', native=000001F8) +i> F80000A0 XThreadF80000A8 (13) Stack: 706A0000-706D0000 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +i> F80000A0 XThreadF80000AC (14) Stack: 706F0000-70720000 +K> F80000A8 XThread::Execute thid 19 (handle=F80000A8, 'XThread01FC (F80000A8)', native=000001FC) +K> F80000AC XThread::Execute thid 20 (handle=F80000AC, 'XThread0200 (F80000AC)', native=00000200) +K> F80000A8 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A4 alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F80000AC AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A4 alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\c\dba806e) +F> F8000098 HostPathDevice::ResolvePath(\87719002\c) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\c\ec0a96e) +F> F8000098 HostPathDevice::ResolvePath(\87719002\c) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000C8 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\a\60fcb85) +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +F> F8000098 HostPathDevice::ResolvePath(\87719002\a) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000D4 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +F> F8000098 HostPathDevice::ResolvePath(\87719002\2\85d8849) +F> F8000098 HostPathDevice::ResolvePath(\87719002\2) +F> F80000A0 DiscImageDevice::ResolvePath(\hidden\Resource3D) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000E4 type=0 initial_state=0 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000E8 type=1 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\a\715f485) +F> F8000098 HostPathDevice::ResolvePath(\87719002\a) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000F4 type=0 initial_state=0 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E8 alertable=0 lr=824AC578 guest_lr=822DFCC8 +F> F8000098 HostPathDevice::ResolvePath(\87719002\c\f2a8ccd) +F> F8000098 HostPathDevice::ResolvePath(\87719002\c) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\0\1a2db9c) +F> F8000098 HostPathDevice::ResolvePath(\87719002\0) +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C515C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000B8 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000C4 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D0 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000DC lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000F0 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C515C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000F8 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E8 result=00000000 lr=824AC578 guest_lr=822DFCC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000100 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E8 alertable=0 lr=824AC578 guest_lr=822DFE24 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000098 result=00000000 lr=824AC578 guest_lr=822F1B50 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F800010C lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000B4 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E8 result=00000000 lr=824AC578 guest_lr=822DFE24 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E8 alertable=0 lr=824AC578 guest_lr=822DFED0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF80000C0 (15) Stack: 705D0000-705E0000 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C4 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F80000C0 XThread::Execute thid 21 (handle=F80000C0, 'XThread0204 (F80000C0)', native=00000204) +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C4 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000094 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E8 result=00000000 lr=824AC578 guest_lr=822DFED0 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000094 type=1 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +i> F8000008 XThreadF8000098 (16) Stack: 70600000-70610000 +K> F8000098 XThread::Execute thid 22 (handle=F8000098, 'XThread0208 (F8000098)', native=00000208) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000CC type=0 initial_state=0 lr=824A9F6C +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000CC lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000CC alertable=0 lr=824AC578 guest_lr=82172BC8 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000CC result=00000000 lr=824AC578 guest_lr=82172BC8 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000094 alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +F> F80000A0 DiscImageDevice::ResolvePath(\hidden\Resource3D) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000D0 type=1 initial_state=0 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFCC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFCC8 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFE24 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E4 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000E8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF80000E4 (17) Stack: 70630000-70640000 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFE24 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFED0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F80000E4 XThread::Execute thid 23 (handle=F80000E4, 'XThread020C (F80000E4)', native=0000020C) +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000F8 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000100 (18) Stack: 70740000-707C0000 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF800010C (19) Stack: 707E0000-70860000 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000100 XThread::Execute thid 24 (handle=F8000100, 'XThread0210 (F8000100)', native=00000210) +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F800010C XThread::Execute thid 25 (handle=F800010C, 'XThread0214 (F800010C)', native=00000214) +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFED0 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +F> F80000A0 DiscImageDevice::ResolvePath(\hidden\Resource3D) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000D0 type=1 initial_state=0 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFCC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFCC8 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B0 alertable=0 lr=824AC578 guest_lr=821CC19C +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000B0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B0 result=00000000 lr=824AC578 guest_lr=821CC19C +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFE24 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000B0 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFE24 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFED0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000B0 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFED0 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\f\ca5c62e) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\d\14ba3f8) +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\d) +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B0 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D0 type=0 initial_state=0 lr=824A9F6C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D0 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B0 result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\8\14c242d) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\5\6324af0) +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\5) +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B0 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D0 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B0 result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\d\70a9531) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\a\c9606f9) +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\a) +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B0 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D0 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B0 result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\7\9f2d535) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\4\efaecd1) +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\4) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B0 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D0 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D0 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B0 result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\7\0c3bba2) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\4\59fbfe8) +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\4) +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B0 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D0 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B0 result=00000000 lr=824AC578 guest_lr=8245FA10 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800009C alertable=0 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800009C result=00000000 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800009C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B0 alertable=0 lr=824AC578 guest_lr=821CC19C +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000B0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B0 result=00000000 lr=824AC578 guest_lr=821CC19C +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800009C alertable=0 lr=824AC578 guest_lr=823DEF4C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800009C result=00000000 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800009C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF80000BC (1A) Stack: 70880000-70900000 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F80000BC XThread::Execute thid 26 (handle=F80000BC, 'XThread0218 (F80000BC)', native=00000218) +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F80000BC AUDIT-HLC NtCreateEvent handle=F80000CC type=1 initial_state=1 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F80000BC AUDIT-HLC NtCreateEvent handle=F80000D0 type=0 initial_state=0 lr=824A9F6C +F> F80000BC HostPathDevice::ResolvePath(\aab216c3\5\c10eae6) +F> F80000BC HostPathDevice::ResolvePath(\aab216c3\5) +K> F80000BC AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=821CBAE0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000110 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 AUDIT-HLC NtSetEvent handle=F8000110 lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000110 result=00000000 lr=824AC578 guest_lr=8245148C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000108 lr=824AA304 +K> F80000BC AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=821CBAE0 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800008C AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +F> F800008C DiscImageDevice::ResolvePath(\dat) +K> F800008C AUDIT-HLC NtSetEvent handle=F8000110 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D8 alertable=0 lr=824AC578 guest_lr=82460150 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D8 result=00000000 lr=824AC578 guest_lr=82460150 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B0 alertable=0 lr=824AC578 guest_lr=82172BC8 +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000B0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B0 result=00000000 lr=824AC578 guest_lr=82172BC8 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +F> F8000008 DiscImageDevice::ResolvePath(\dat\movie) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000118 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800011C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000120 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000124 type=0 initial_state=1 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000128 type=0 initial_state=1 lr=824A9F6C +F> F8000008 DiscImageDevice::ResolvePath(\dat\movie) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000130 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000134 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000138 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800013C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000140 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000144 type=0 initial_state=1 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000148 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800014C type=0 initial_state=1 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +i> F8000008 XThreadF8000150 (1B) Stack: 70880000-70890000 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +i> F8000008 XThreadF8000154 (1C) Stack: 708B0000-708C0000 +i> F8000008 XThreadF8000158 (1D) Stack: 708E0000-708F0000 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +i> F8000008 XThreadF800015C (1E) Stack: 70910000-70920000 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25404 lr=82507ABC +K> F8000150 XThread::Execute thid 27 (handle=F8000150, 'XThread021C (F8000150)', native=0000021C) +K> F8000154 XThread::Execute thid 28 (handle=F8000154, 'XThread0220 (F8000154)', native=00000220) +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 XThread::Execute thid 29 (handle=F8000158, 'XThread0224 (F8000158)', native=00000224) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C diff --git a/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.log.run4_toml b/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.log.run4_toml new file mode 100644 index 0000000..e71f97f --- /dev/null +++ b/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.log.run4_toml @@ -0,0 +1,36329 @@ +i> 000000D4 Build: canary_experimental@99fd19d02 on Jun 5 2026 +i> 000000D4 Storage root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug +i> 000000D4 ----------- CONFIG DUMP ----------- + +[APU] +apu = "any" +apu_max_queued_frames = 8 +enable_xmp = true +ffmpeg_verbose = false +mute = false +use_dedicated_xma_thread = true +xma_decoder = "new" + +[Auditing] +audit_handle_lifecycle = true +audit_jit_prolog_pc = 2182835700 + +[CPU] +break_condition_gpr = -1 +break_condition_op = "eq" +break_condition_truncate = true +break_condition_value = 0 +break_on_debugbreak = true +break_on_instruction = 0 +break_on_start = false +break_on_unimplemented_instructions = true +clock_no_scaling = false +clock_source_raw = false +cpu = "any" +debug_symbol_loader = false +debugprint_trap_log = false +disable_context_promotion = false +disable_instruction_infocache = false +disable_prefetch_and_cachecontrol = true +disassemble_functions = false +dump_translated_hir_functions = false +elide_e0_check = false +emit_inline_mmio_checks = false +emit_mmio_aware_stores_for_recorded_exception_addresses = true +emit_source_annotations = false +enable_early_precompilation = false +full_optimization_even_with_debug = false +ignore_trap_instructions = true +ignore_undefined_externs = true +inline_loadclock = false +inline_mmio_access = true +load_module_map = "" +no_reserved_ops = false +no_round_to_single = false +permit_float_constant_evaluation = false +pvr = 7407360 +record_mmio_access_exceptions = true +store_all_context_values = false +trace_function_coverage = false +trace_function_data = false +trace_function_data_path = "" +trace_function_references = false +trace_functions = false +use_fast_dot_product = false +validate_hir = false +writable_code_segments = false + +[Config] +defaults_date = 2026040912 + +[Content] +license_mask = 0 + +[D3D12] +d3d12_adapter = -1 +d3d12_allow_variable_refresh_rate_and_tearing = true +d3d12_bindless = true +d3d12_break_on_error = false +d3d12_break_on_warning = false +d3d12_debug = false +d3d12_dxbc_disasm = false +d3d12_dxbc_disasm_dxilconv = false +d3d12_pipeline_creation_threads = -1 +d3d12_queue_priority = 1 +d3d12_submit_on_primary_buffer_end = true +d3d12_tessellation_wireframe = false + +[Display] +fullscreen = false +host_present_from_non_ui_thread = true +postprocess_antialiasing = "" +postprocess_dither = true +postprocess_ffx_cas_additional_sharpness = 0 +postprocess_ffx_fsr_max_upsampling_passes = 4 +postprocess_ffx_fsr_sharpness_reduction = 0.20000000298023224 +postprocess_scaling_and_sharpening = "" +present_letterbox = true +present_render_pass_clear = true +present_safe_area_x = 100 +present_safe_area_y = 100 + +[GPU] +anisotropic_override = -1 +async_shader_compilation = true +clear_memory_page_state = false +depth_float24_convert_in_pixel_shader = false +depth_float24_round = false +depth_transfer_not_equal_test = true +disassemble_pm4 = false +draw_resolution_scale_x = 1 +draw_resolution_scale_y = 1 +draw_resolution_scaled_texture_offsets = true +dump_shaders = "" +dxbc_source_map = false +dxbc_switch = true +execute_unclipped_draw_vs_on_cpu = true +execute_unclipped_draw_vs_on_cpu_for_psi_render_backend = true +execute_unclipped_draw_vs_on_cpu_with_scissor = false +force_convert_line_loops_to_strips = false +force_convert_quad_lists_to_triangle_lists = false +force_convert_triangle_fans_to_lists = false +framerate_limit = 0 +gamma_render_target_as_unorm16 = true +gpu = "any" +gpu_3d_to_2d_texture = true +gpu_allow_invalid_fetch_constants = true +gpu_allow_invalid_upload_range = false +half_pixel_offset = true +ignore_32bit_vertex_index_support = false +log_guest_driven_gpu_register_written_values = false +log_ringbuffer_kickoff_initiator_bts = false +mrt_edram_used_range_clamp_to_min = true +native_2x_msaa = true +native_stencil_value_output = true +native_stencil_value_output_d3d12_intel = false +no_discard_stencil_in_transfer_pipelines = false +non_seamless_cube_map = true +occlusion_query = "fast" +occlusion_query_fake_lower_threshold = 80 +occlusion_query_fake_upper_threshold = 100 +occlusion_query_querybatch_range = 0 +occlusion_query_saturation = 1 +primitive_processor_cache_min_indices = 4096 +readback_memexport = false +readback_resolve = "none" +render_target_path_d3d12 = "" +render_target_path_vulkan = "" +resolve_resolution_scale_fill_half_pixel_offset = true +snorm16_render_target_full_range = true +store_shaders = true +target_trace_file = "" +texture_cache_memory_limit_hard = 768 +texture_cache_memory_limit_render_to_texture = 24 +texture_cache_memory_limit_soft = 384 +texture_cache_memory_limit_soft_lifetime = 30 +tiled_shared_memory = true +trace_dump_path = "" +trace_gpu_prefix = "scratch/gpu/" +trace_gpu_stream = false +use_fuzzy_alpha_epsilon = false +vsync = true + +[General] +allow_game_relative_writes = false +allow_plugins = false +apply_patches = true +controller_hotkeys = false +debug = false +disable_doubleclick_fullscreen = false +discord = true +launch_module = "" +notification_sound_path = "" +priority_class = 0 +recent_titles_entry_amount = 10 +time_scalar = 1 + +[HACKS] +ac6_ground_fix = false + +[HID] +guide_button = true +hid = "any" +keyboard_mode = 0 +keyboard_user_index = 0 +left_stick_deadzone_percentage = 0 +right_stick_deadzone_percentage = 0 +vibration = true + +[HID.WinKey] +keybind_a = "0xBA" +keybind_b = "0xDE" +keybind_back = "Z" +keybind_dpad_down = "^S" +keybind_dpad_left = "^A" +keybind_dpad_right = "^D" +keybind_dpad_up = "^W" +keybind_guide = "0x08" +keybind_left_shoulder = "1" +keybind_left_thumb = "F" +keybind_left_thumb_down = "_S" +keybind_left_thumb_left = "_A" +keybind_left_thumb_right = "_D" +keybind_left_thumb_up = "_W" +keybind_left_trigger = "Q I" +keybind_right_shoulder = "3" +keybind_right_thumb = "K" +keybind_right_thumb_down = "0x28" +keybind_right_thumb_left = "0x25" +keybind_right_thumb_right = "0x27" +keybind_right_thumb_up = "0x26" +keybind_right_trigger = "E O" +keybind_start = "X" +keybind_x = "L" +keybind_y = "P" + +[Kernel] +allow_avatar_initialization = false +allow_incompatible_title_update = true +apply_title_update = true +cl = "" +console_type = 0 +default_achievements_backend = "GPD" +ignore_thread_affinities = true +ignore_thread_priorities = false +kernel_build_version = 1888 +kernel_cert_monitor = false +kernel_debug_monitor = false +kernel_display_gamma_power = 2.22222233 +kernel_display_gamma_type = 2 +kernel_pix = false +staging_mode = false + +[Logging] +enable_console = false +flush_log = true +log_file = "" +log_high_frequency_kernel_calls = false +log_level = 2 +log_mask = 0 +log_string_format_kernel_calls = false +log_to_debugprint = false +log_to_stdout = true + +[Memory] +ignore_offset_for_ranged_allocations = false +protect_on_release = false +protect_zero = true +scribble_heap = false +scribble_heap_value = 0 +writable_executable_memory = true + +[Profiles] +logged_profile_slot_0_xuid = "" +logged_profile_slot_1_xuid = "" +logged_profile_slot_2_xuid = "" +logged_profile_slot_3_xuid = "" + +[SDL] +mappings_file = "gamecontrollerdb.txt" + +[Storage] +cache_root = "" +content_root = "" +force_mount_devkit = false +mount_cache = true +mount_memory_unit = false +mount_scratch = false +storage_root = "" + +[UI] +custom_font_path = "" +font_size = 14 +headless = false +imgui_debug = false +profiler_dpi_scaling = false +show_achievement_notification = false +show_profiler = false +storage_selection_dialog = false +window_size_x = 1280 +window_size_y = 720 + +[Video] +avpack = 8 +custom_internal_display_resolution_x = 0 +custom_internal_display_resolution_y = 0 +enable_3d_mode = false +interlaced = false + +[Vulkan] +vulkan_allow_present_mode_fifo_relaxed = true +vulkan_allow_present_mode_immediate = true +vulkan_allow_present_mode_mailbox = true +vulkan_device = -1 +vulkan_log_debug_messages = true +vulkan_pipeline_creation_threads = -1 +vulkan_semaphore_reuse_workaround = false +vulkan_sparse_shared_memory = true +vulkan_validation = false + +[Win32] +win32_high_resolution_timer = true +win32_mmcss = true + +[x64] +align_all_basic_blocks = 0 +delay_via_maybeyield = false +enable_host_guest_stack_synchronization = true +enable_incorrect_roundingmode_behavior = false +enable_rmw_context_merging = false +instrument_call_times = false +max_stackpoints = 65536 +x64_extension_mask = -1 +xop_arithmetic_right_shifts = false +xop_compares = true +xop_left_shifts = false +xop_right_shifts = false +xop_rotates = false +----------- END OF CONFIG DUMP ---- +i> 000000D4 Loaded config: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\xenia-canary.config.toml +i> 000000D4 Content root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\content +i> 000000D4 Host cache root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\cache_host +w> 000000D4 Unable to load Japanese font; JP characters will be boxes +w> 000000D4 Unable to load Japanese font; JP characters will be boxes +i> 00000124 Setup: Initializing Memory... +i> 00000124 Setup: Initializing Exports... +i> 00000124 Setup: Initializing Processor... +i> 00000124 Setup: Initializing Audio... +i> 00000124 Setup: Initializing Graphics... +i> 00000124 Setup: Initializing HID... +i> 00000124 winkey: "0x08" binds key 0x8 to controller input GUIDE. +i> 00000124 winkey: "^A" binds key 0x41 to controller input DPAD_LEFT. +i> 00000124 winkey: "^D" binds key 0x44 to controller input DPAD_RIGHT. +i> 00000124 winkey: "^S" binds key 0x53 to controller input DPAD_DOWN. +i> 00000124 winkey: "^W" binds key 0x57 to controller input DPAD_UP. +i> 00000124 winkey: "_A" binds key 0x41 to controller input LEFT_THUMB_LEFT. +i> 00000124 winkey: "_D" binds key 0x44 to controller input LEFT_THUMB_RIGHT. +i> 00000124 winkey: "_S" binds key 0x53 to controller input LEFT_THUMB_DOWN. +i> 00000124 winkey: "_W" binds key 0x57 to controller input LEFT_THUMB_UP. +i> 00000124 winkey: "F" binds key 0x46 to controller input LEFT_THUMB_PRESSED. +i> 00000124 winkey: "0x26" binds key 0x26 to controller input RIGHT_THUMB_UP. +i> 00000124 winkey: "0x28" binds key 0x28 to controller input RIGHT_THUMB_DOWN. +i> 00000124 winkey: "0x27" binds key 0x27 to controller input RIGHT_THUMB_RIGHT. +i> 00000124 winkey: "0x25" binds key 0x25 to controller input RIGHT_THUMB_LEFT. +i> 00000124 winkey: "K" binds key 0x4B to controller input RIGHT_THUMB_PRESSED. +i> 00000124 winkey: "L" binds key 0x4C to controller input X. +i> 00000124 winkey: "0xDE" binds key 0xDE to controller input B. +i> 00000124 winkey: "0xBA" binds key 0xBA to controller input A. +i> 00000124 winkey: "P" binds key 0x50 to controller input Y. +i> 00000124 winkey: "Q" binds key 0x51 to controller input LEFT_TRIGGER. +i> 00000124 winkey: "I" binds key 0x49 to controller input LEFT_TRIGGER. +i> 00000124 winkey: "E" binds key 0x45 to controller input RIGHT_TRIGGER. +i> 00000124 winkey: "O" binds key 0x4F to controller input RIGHT_TRIGGER. +i> 00000124 winkey: "Z" binds key 0x5A to controller input BACK. +i> 00000124 winkey: "X" binds key 0x58 to controller input START. +i> 00000124 winkey: "1" binds key 0x31 to controller input LEFT_SHOULDER. +i> 00000124 winkey: "3" binds key 0x33 to controller input RIGHT_SHOULDER. +i> 000000D4 SDL Version 2.32.2 initialized. +w> 000000D4 SDL GameControllerDB: file 'gamecontrollerdb.txt' does not exist. +i> 00000124 Setup: Initializing VFS... +i> 00000124 PatchDB: Loaded patches for 0 titles +i> 00000124 Setup: Initializing Kernel... +i> 00000124 ProfileManager: Found 0 Profiles +w> 00000124 BaseHeap::AllocFixed attempting commit on unreserved page +w> 00000124 BaseHeap::AllocFixed attempting commit on unreserved page +i> 00000124 Setup: Starting graphics_system... +i> 00000124 DXGI adapter: NVIDIA GeForce GTX 1070 Ti (vendor 0x1002, device 0x73DF) +i> 00000124 Direct3D 12 device and OS features: +* Max GPU virtual address bits per resource: 40 +* Non-zeroed heap creation: yes +* Pixel-shader-specified stencil reference: no +* Programmable sample positions: tier 0 +* Rasterizer-ordered views: yes +* Resource binding: tier 3 +* Tiled resources: tier 4 +* Unaligned block-compressed textures: yes +i> 00000124 XThread01000010 (1) Stack: 70010000-70030000 +i> 00000124 XThread01000014 (2) Stack: 70050000-70070000 +i> 00000124 Setup: Starting audio_system... +K> 01000010 XThread::Execute thid 1 (handle=01000010, 'GPU Commands (01000010)', native=00000154, ) +K> 01000014 XThread::Execute thid 2 (handle=01000014, 'GPU Frame limiter (01000014)', native=00000158, ) +i> 00000124 XThread01000018 (3) Stack: 70090000-700B0000 +i> 00000124 XThread0100001C (4) Stack: 700D0000-700F0000 +K> 01000018 XThread::Execute thid 3 (handle=01000018, 'XMA Decoder (01000018)', native=00000180, ) +K> 0100001C XThread::Execute thid 4 (handle=0100001C, 'Audio Worker (0100001C)', native=00000184, ) +i> 000000D4 Checking for XISO +F> 000000D4 DiscImageDevice::Initialize +i> 000000D4 Checking for XISO +F> 000000D4 DiscImageDevice::Initialize +F> 000000D4 DiscImageDevice::Initialize +i> 000000D4 Loading module GAME:\default.xex +F> 000000D4 DiscImageDevice::ResolvePath(\default.xex) +i> 000000D4 Module \Device\Cdrom0\default.xex: +Module Hash: CCF935D24A74E002 + Module Flags: 00000001 + XEX_MODULE_TITLE +Security Header: + Image Flags: 00000008 + XEX_IMAGE_XGD2_MEDIA_ONLY + Load Address: 82000000 + Image Size: 00920000 + Export Table: 00000000 +Optional Header Count: 15 + XEX_HEADER_RESOURCE_INFO: + 535107D4 828FB900-8291D8CF, 139215b + XEX_HEADER_FILE_FORMAT_INFO: + Info Size: 36 + Encryption Type: Normal + Compression Type: Normal + Window Size: 32768 + Block Size: 61440 + Block Hash: B3 2B D7 D4 EF 96 9A C5 9F D7 77 C6 8A 99 AA 1C BD 87 1C BE 00 90 2E F1 46 3F A3 D7 00 00 00 10 + XEX_HEADER_ENTRY_POINT: 824AB748 + XEX_HEADER_IMAGE_BASE_ADDRESS: 82000000 + XEX_HEADER_IMPORT_LIBRARIES: + xam.xex - 104 imports + Version: 2.0.4552.0 + Min Version: 2.0.4552.0 + xboxkrnl.exe - 294 imports + Version: 2.0.4552.0 + Min Version: 2.0.4552.0 + XEX_HEADER_CHECKSUM_TIMESTAMP: + Checksum : 00902EF1 + Time Stamp: 463FA3D7 - Tue May 8 00:10:31 2007 + XEX_HEADER_ORIGINAL_PE_NAME: default.pe + XEX_HEADER_STATIC_LIBRARIES: + XAPILIB : 2.0.3215.0 + D3D9 : 2.0.3215.1 + D3DX9 : 2.0.3215.0 + XBOXKRNL : 2.0.3215.0 + XAUD : 2.0.3215.0 + LIBCPMT : 2.0.3215.0 + XMP : 2.0.3215.0 + XMEDIA : 2.0.3215.0 + XONLINE : 2.0.3215.0 + XGRAPHC : 2.0.3215.0 + X3DAUD : 2.0.3215.1 + XACT : 2.0.3215.1 + XEX_HEADER_TLS_INFO: + Slot Count: 64 + Raw Data Address: 00000000 + Data Size: 0 + Raw Data Size: 0 + XEX_HEADER_DEFAULT_STACK_SIZE: 524288 + XEX_HEADER_SYSTEM_FLAGS: 00000400 + XEX_SYSTEM_PAL50_INCOMPATIBLE + XEX_HEADER_EXECUTION_INFO: + Media ID: 2D2E2EEB + Title ID: 535107D4 + Savegame ID: 535107D4 + Disc Number / Total: 1 / 1 + XEX_HEADER_GAME_RATINGS: + ESRB: Teen + PEGI: 12+ + PEGI-FI: 11+ + PEGI - PT: 12+ + BBFC: 12+ + CERO: Unrated + USK: Approved for children aged 12 and above + OFLC - AU: Parental Guidance + OFLC - NZ: Parental Guidance + KMRB: Unrated + Brazil: Unrated + FPB: 13+ + XEX_HEADER_LAN_KEY: E0 3C EA 47 3C AE 06 62 98 8F DB 7F 58 50 12 38 + XEX_HEADER_XBOX360_LOGO: + Section Size: 1736 + Logo Size: 1728 +Sections: + 0 RODATA 1 pages 82000000 - 82010000 (65536 bytes) + 1 RODATA 1 pages 82010000 - 82020000 (65536 bytes) + 2 RODATA 1 pages 82020000 - 82030000 (65536 bytes) + 3 RODATA 1 pages 82030000 - 82040000 (65536 bytes) + 4 RODATA 1 pages 82040000 - 82050000 (65536 bytes) + 5 RODATA 1 pages 82050000 - 82060000 (65536 bytes) + 6 RODATA 1 pages 82060000 - 82070000 (65536 bytes) + 7 RODATA 1 pages 82070000 - 82080000 (65536 bytes) + 8 RODATA 1 pages 82080000 - 82090000 (65536 bytes) + 9 RODATA 1 pages 82090000 - 820A0000 (65536 bytes) + 10 RODATA 1 pages 820A0000 - 820B0000 (65536 bytes) + 11 RODATA 1 pages 820B0000 - 820C0000 (65536 bytes) + 12 RODATA 1 pages 820C0000 - 820D0000 (65536 bytes) + 13 RODATA 1 pages 820D0000 - 820E0000 (65536 bytes) + 14 RODATA 1 pages 820E0000 - 820F0000 (65536 bytes) + 15 RODATA 1 pages 820F0000 - 82100000 (65536 bytes) + 16 RODATA 1 pages 82100000 - 82110000 (65536 bytes) + 17 RODATA 1 pages 82110000 - 82120000 (65536 bytes) + 18 RODATA 1 pages 82120000 - 82130000 (65536 bytes) + 19 RODATA 1 pages 82130000 - 82140000 (65536 bytes) + 20 RODATA 1 pages 82140000 - 82150000 (65536 bytes) + 21 CODE 1 pages 82150000 - 82160000 (65536 bytes) + 22 CODE 1 pages 82160000 - 82170000 (65536 bytes) + 23 CODE 1 pages 82170000 - 82180000 (65536 bytes) + 24 CODE 1 pages 82180000 - 82190000 (65536 bytes) + 25 CODE 1 pages 82190000 - 821A0000 (65536 bytes) + 26 CODE 1 pages 821A0000 - 821B0000 (65536 bytes) + 27 CODE 1 pages 821B0000 - 821C0000 (65536 bytes) + 28 CODE 1 pages 821C0000 - 821D0000 (65536 bytes) + 29 CODE 1 pages 821D0000 - 821E0000 (65536 bytes) + 30 CODE 1 pages 821E0000 - 821F0000 (65536 bytes) + 31 CODE 1 pages 821F0000 - 82200000 (65536 bytes) + 32 CODE 1 pages 82200000 - 82210000 (65536 bytes) + 33 CODE 1 pages 82210000 - 82220000 (65536 bytes) + 34 CODE 1 pages 82220000 - 82230000 (65536 bytes) + 35 CODE 1 pages 82230000 - 82240000 (65536 bytes) + 36 CODE 1 pages 82240000 - 82250000 (65536 bytes) + 37 CODE 1 pages 82250000 - 82260000 (65536 bytes) + 38 CODE 1 pages 82260000 - 82270000 (65536 bytes) + 39 CODE 1 pages 82270000 - 82280000 (65536 bytes) + 40 CODE 1 pages 82280000 - 82290000 (65536 bytes) + 41 CODE 1 pages 82290000 - 822A0000 (65536 bytes) + 42 CODE 1 pages 822A0000 - 822B0000 (65536 bytes) + 43 CODE 1 pages 822B0000 - 822C0000 (65536 bytes) + 44 CODE 1 pages 822C0000 - 822D0000 (65536 bytes) + 45 CODE 1 pages 822D0000 - 822E0000 (65536 bytes) + 46 CODE 1 pages 822E0000 - 822F0000 (65536 bytes) + 47 CODE 1 pages 822F0000 - 82300000 (65536 bytes) + 48 CODE 1 pages 82300000 - 82310000 (65536 bytes) + 49 CODE 1 pages 82310000 - 82320000 (65536 bytes) + 50 CODE 1 pages 82320000 - 82330000 (65536 bytes) + 51 CODE 1 pages 82330000 - 82340000 (65536 bytes) + 52 CODE 1 pages 82340000 - 82350000 (65536 bytes) + 53 CODE 1 pages 82350000 - 82360000 (65536 bytes) + 54 CODE 1 pages 82360000 - 82370000 (65536 bytes) + 55 CODE 1 pages 82370000 - 82380000 (65536 bytes) + 56 CODE 1 pages 82380000 - 82390000 (65536 bytes) + 57 CODE 1 pages 82390000 - 823A0000 (65536 bytes) + 58 CODE 1 pages 823A0000 - 823B0000 (65536 bytes) + 59 CODE 1 pages 823B0000 - 823C0000 (65536 bytes) + 60 CODE 1 pages 823C0000 - 823D0000 (65536 bytes) + 61 CODE 1 pages 823D0000 - 823E0000 (65536 bytes) + 62 CODE 1 pages 823E0000 - 823F0000 (65536 bytes) + 63 CODE 1 pages 823F0000 - 82400000 (65536 bytes) + 64 CODE 1 pages 82400000 - 82410000 (65536 bytes) + 65 CODE 1 pages 82410000 - 82420000 (65536 bytes) + 66 CODE 1 pages 82420000 - 82430000 (65536 bytes) + 67 CODE 1 pages 82430000 - 82440000 (65536 bytes) + 68 CODE 1 pages 82440000 - 82450000 (65536 bytes) + 69 CODE 1 pages 82450000 - 82460000 (65536 bytes) + 70 CODE 1 pages 82460000 - 82470000 (65536 bytes) + 71 CODE 1 pages 82470000 - 82480000 (65536 bytes) + 72 CODE 1 pages 82480000 - 82490000 (65536 bytes) + 73 CODE 1 pages 82490000 - 824A0000 (65536 bytes) + 74 CODE 1 pages 824A0000 - 824B0000 (65536 bytes) + 75 CODE 1 pages 824B0000 - 824C0000 (65536 bytes) + 76 CODE 1 pages 824C0000 - 824D0000 (65536 bytes) + 77 CODE 1 pages 824D0000 - 824E0000 (65536 bytes) + 78 CODE 1 pages 824E0000 - 824F0000 (65536 bytes) + 79 CODE 1 pages 824F0000 - 82500000 (65536 bytes) + 80 CODE 1 pages 82500000 - 82510000 (65536 bytes) + 81 CODE 1 pages 82510000 - 82520000 (65536 bytes) + 82 CODE 1 pages 82520000 - 82530000 (65536 bytes) + 83 CODE 1 pages 82530000 - 82540000 (65536 bytes) + 84 CODE 1 pages 82540000 - 82550000 (65536 bytes) + 85 CODE 1 pages 82550000 - 82560000 (65536 bytes) + 86 CODE 1 pages 82560000 - 82570000 (65536 bytes) + 87 CODE 1 pages 82570000 - 82580000 (65536 bytes) + 88 CODE 1 pages 82580000 - 82590000 (65536 bytes) + 89 CODE 1 pages 82590000 - 825A0000 (65536 bytes) + 90 CODE 1 pages 825A0000 - 825B0000 (65536 bytes) + 91 CODE 1 pages 825B0000 - 825C0000 (65536 bytes) + 92 CODE 1 pages 825C0000 - 825D0000 (65536 bytes) + 93 CODE 1 pages 825D0000 - 825E0000 (65536 bytes) + 94 CODE 1 pages 825E0000 - 825F0000 (65536 bytes) + 95 CODE 1 pages 825F0000 - 82600000 (65536 bytes) + 96 CODE 1 pages 82600000 - 82610000 (65536 bytes) + 97 CODE 1 pages 82610000 - 82620000 (65536 bytes) + 98 CODE 1 pages 82620000 - 82630000 (65536 bytes) + 99 CODE 1 pages 82630000 - 82640000 (65536 bytes) + 100 CODE 1 pages 82640000 - 82650000 (65536 bytes) + 101 CODE 1 pages 82650000 - 82660000 (65536 bytes) + 102 CODE 1 pages 82660000 - 82670000 (65536 bytes) + 103 CODE 1 pages 82670000 - 82680000 (65536 bytes) + 104 CODE 1 pages 82680000 - 82690000 (65536 bytes) + 105 CODE 1 pages 82690000 - 826A0000 (65536 bytes) + 106 CODE 1 pages 826A0000 - 826B0000 (65536 bytes) + 107 CODE 1 pages 826B0000 - 826C0000 (65536 bytes) + 108 CODE 1 pages 826C0000 - 826D0000 (65536 bytes) + 109 CODE 1 pages 826D0000 - 826E0000 (65536 bytes) + 110 CODE 1 pages 826E0000 - 826F0000 (65536 bytes) + 111 CODE 1 pages 826F0000 - 82700000 (65536 bytes) + 112 CODE 1 pages 82700000 - 82710000 (65536 bytes) + 113 CODE 1 pages 82710000 - 82720000 (65536 bytes) + 114 CODE 1 pages 82720000 - 82730000 (65536 bytes) + 115 CODE 1 pages 82730000 - 82740000 (65536 bytes) + 116 CODE 1 pages 82740000 - 82750000 (65536 bytes) + 117 CODE 1 pages 82750000 - 82760000 (65536 bytes) + 118 CODE 1 pages 82760000 - 82770000 (65536 bytes) + 119 CODE 1 pages 82770000 - 82780000 (65536 bytes) + 120 CODE 1 pages 82780000 - 82790000 (65536 bytes) + 121 CODE 1 pages 82790000 - 827A0000 (65536 bytes) + 122 CODE 1 pages 827A0000 - 827B0000 (65536 bytes) + 123 CODE 1 pages 827B0000 - 827C0000 (65536 bytes) + 124 CODE 1 pages 827C0000 - 827D0000 (65536 bytes) + 125 CODE 1 pages 827D0000 - 827E0000 (65536 bytes) + 126 CODE 1 pages 827E0000 - 827F0000 (65536 bytes) + 127 CODE 1 pages 827F0000 - 82800000 (65536 bytes) + 128 CODE 1 pages 82800000 - 82810000 (65536 bytes) + 129 CODE 1 pages 82810000 - 82820000 (65536 bytes) + 130 CODE 1 pages 82820000 - 82830000 (65536 bytes) + 131 CODE 1 pages 82830000 - 82840000 (65536 bytes) + 132 CODE 1 pages 82840000 - 82850000 (65536 bytes) + 133 CODE 1 pages 82850000 - 82860000 (65536 bytes) + 134 CODE 1 pages 82860000 - 82870000 (65536 bytes) + 135 RWDATA 1 pages 82870000 - 82880000 (65536 bytes) + 136 RWDATA 1 pages 82880000 - 82890000 (65536 bytes) + 137 RWDATA 1 pages 82890000 - 828A0000 (65536 bytes) + 138 RWDATA 1 pages 828A0000 - 828B0000 (65536 bytes) + 139 RWDATA 1 pages 828B0000 - 828C0000 (65536 bytes) + 140 RWDATA 1 pages 828C0000 - 828D0000 (65536 bytes) + 141 RWDATA 1 pages 828D0000 - 828E0000 (65536 bytes) + 142 RWDATA 1 pages 828E0000 - 828F0000 (65536 bytes) + 143 RWDATA 1 pages 828F0000 - 82900000 (65536 bytes) + 144 RWDATA 1 pages 82900000 - 82910000 (65536 bytes) + 145 RWDATA 1 pages 82910000 - 82920000 (65536 bytes) +Imports: + xam - 52 imports + Version: 0.0.4552.32 + Min Version: 0.0.4552.32 + + Total: 52 + Known: 100% (52 known, 0 unknown) + Implemented: 98% (51 implemented, 1 unimplemented) + + F 82000600 8284DA7C 28C ( 652) XNotifyPositionUI + F 82000604 8284DA8C 2BC ( 700) XamShowSigninUI + F 82000608 8284DA9C 2C1 ( 705) XamShowKeyboardUI + F 8200060C 8284DAAC 2D5 ( 725) !! XamShowGamerCardUIForXUID + F 82000610 8284DABC 2CB ( 715) XamShowDeviceSelectorUI + F 82000614 8284DACC 2D9 ( 729) XamShowDirtyDiscErrorUI + F 82000618 8284DADC 1B3 ( 435) XamTaskShouldExit + F 8200061C 8284DAEC 1B1 ( 433) XamTaskCloseHandle + F 82000620 8284DAFC 1AF ( 431) XamTaskSchedule + F 82000624 8284DB0C 1A4 ( 420) XamLoaderLaunchTitle + F 82000628 8284DB1C 1F7 ( 503) XMsgStartIORequest + F 8200062C 8284DB2C 20E ( 526) XamUserGetName + F 82000630 8284DB3C 210 ( 528) XamUserGetSigninState + F 82000634 8284DB4C 282 ( 642) XamGetSystemVersion + F 82000638 8284DB5C 2F7 ( 759) XamUserCreateStatsEnumerator + F 8200063C 8284DB6C 2EE ( 750) XamUserCreateAchievementEnumerator + F 82000640 8284DB7C 20A ( 522) XamUserGetXUID + F 82000644 8284DB8C 250 ( 592) XamEnumerate + F 82000648 8284DB9C 3CC ( 972) XGetGameRegion + F 8200064C 8284DBAC 190 ( 400) XamInputGetCapabilities + F 82000650 8284DBBC 191 ( 401) XamInputGetState + F 82000654 8284DBCC 192 ( 402) XamInputSetState + F 82000658 8284DBDC 198 ( 408) XamInputGetKeystrokeEx + F 8200065C 8284DBEC 258 ( 600) XamContentCreate + F 82000660 8284DBFC 25B ( 603) XamContentDelete + F 82000664 8284DC0C 25A ( 602) XamContentClose + F 82000668 8284DC1C 260 ( 608) XamContentSetThumbnail + F 8200066C 8284DC2C 262 ( 610) XamContentGetCreator + F 82000670 8284DC3C 25C ( 604) XamContentCreateEnumerator + F 82000674 8284DC4C 265 ( 613) XamContentGetDeviceState + F 82000678 8284DC5C 25E ( 606) XamContentGetDeviceData + F 8200067C 8284DC6C 25F ( 607) XamContentGetDeviceName + F 82000680 8284DC7C 1A0 ( 416) XamEnableInactivityProcessing + F 82000684 8284DC8C 1A1 ( 417) XamResetInactivity + F 82000688 8284DC9C 2DC ( 732) XamShowMessageBoxUIEx + F 8200068C 8284DCAC 3CD ( 973) XGetLanguage + F 82000690 8284DCBC 3CB ( 971) XGetAVPack + F 82000694 8284DCCC 1A9 ( 425) XamLoaderTerminateTitle + F 82000698 8284DCDC 280 ( 640) XamGetExecutionId + F 8200069C 8284E45C 28B ( 651) XNotifyGetNext + F 820006A0 8284E44C 002 ( 2) NetDll_WSACleanup + F 820006A4 8284E43C 001 ( 1) NetDll_WSAStartup + F 820006A8 8284E46C 28A ( 650) XamNotifyCreateListener + F 820006AC 8284E42C 316 ( 790) XamSessionCreateHandle + F 820006B0 8284E41C 317 ( 791) XamSessionRefObjByHandle + F 820006B4 8284E40C 21A ( 538) XamUserWriteProfileSettings + F 820006B8 8284E3FC 219 ( 537) XamUserReadProfileSettings + F 820006BC 8284E3EC 1EA ( 490) XamAlloc + F 820006C0 8284E3DC 1EC ( 492) XamFree + F 820006C4 8284E3CC 3D1 ( 977) XGetVideoMode + F 820006C8 8284E3BC 1F4 ( 500) XMsgInProcessCall + F 820006CC 8284E3AC 1FC ( 508) XMsgStartIORequestEx + + xboxkrnl - 152 imports + Version: 0.0.4552.32 + Min Version: 0.0.4552.32 + + Total: 152 + Known: 100% (152 known, 0 unknown) + Implemented: 95% (145 implemented, 7 unimplemented) + + F 820006D4 8284E1FC 0B4 ( 180) KfReleaseSpinLock + F 820006D8 8284E20C 0B1 ( 177) KfAcquireSpinLock + F 820006DC 8284E21C 1DF ( 479) KiApcNormalRoutineNop + F 820006E0 8284E22C 1B6 ( 438) VdEnableRingBufferRPtrWriteBack + F 820006E4 8284E23C 1C3 ( 451) VdInitializeRingBuffer + F 820006E8 8284E24C 0BE ( 190) MmGetPhysicalAddress + F 820006EC 8284E25C 1D9 ( 473) VdSetSystemCommandBufferGpuIdentifierAddress + F 820006F0 8284E26C 13B ( 315) sprintf + F 820006F4 8284E27C 1B9 ( 441) VdGetCurrentDisplayGamma + V 820006F8 266 ( 614) KeCertMonitorData + F 820006FC 8284E28C 14D ( 333) _vsnprintf + V 82000700 158 ( 344) XboxKrnlVersion + F 82000704 8284E29C 1DC ( 476) VdShutdownEngines + F 82000708 8284E2AC 1CA ( 458) VdQueryVideoMode + F 8200070C 8284E2BC 1BA ( 442) VdGetCurrentDisplayInformation + F 82000710 8284E2CC 1D3 ( 467) VdSetDisplayMode + F 82000714 8284E2DC 1D5 ( 469) VdSetGraphicsInterruptCallback + F 82000718 8284E2EC 1C2 ( 450) VdInitializeEngines + F 8200071C 8284E2FC 1C6 ( 454) VdIsHSIOTrainingSucceeded + F 82000720 8284E30C 1C9 ( 457) VdQueryVideoFlags + F 82000724 8284E31C 1B1 ( 433) VdCallGraphicsNotificationRoutines + V 82000728 1C0 ( 448) VdGpuClockInMHz + F 8200072C 8284E32C 1C5 ( 453) VdInitializeScalerCommandBuffer + F 82000730 8284E33C 269 ( 617) VdRetrainEDRAM + F 82000734 8284E34C 26A ( 618) VdRetrainEDRAMWorker + V 82000738 1C1 ( 449) VdHSIOCalibrationLock + F 8200073C 8284E35C 06B ( 107) KeLockL2 + F 82000740 8284E36C 06C ( 108) KeUnlockL2 + F 82000744 8284E37C 1C7 ( 455) VdPersistDisplay + F 82000748 8284E38C 25B ( 603) VdSwap + F 8200074C 8284E39C 1BD ( 445) VdGetSystemCommandBuffer + V 82000750 1BE ( 446) VdGlobalDevice + F 82000754 8284E1EC 04D ( 77) KeAcquireSpinLockAtRaisedIrql + F 82000758 8284E1DC 089 ( 137) KeReleaseSpinLockFromRaisedIrql + F 8200075C 8284E1CC 1B4 ( 436) VdEnableDisableClockGating + F 82000760 8284E1BC 13F ( 319) RtlTimeFieldsToTime + F 82000764 8284E1AC 136 ( 310) RtlRaiseException + F 82000768 8284E19C 0EE ( 238) NtQueryVirtualMemory + F 8200076C 8284E18C 11B ( 283) RtlCompareMemoryUlong + F 82000770 8284E17C 066 ( 102) KeGetCurrentProcessType + F 82000774 8284E16C 053 ( 83) KeBugCheckEx + F 82000778 8284E15C 126 ( 294) RtlFillMemoryUlong + V 8200077C 1AE ( 430) ExLoadedCommandLine + F 82000780 8284E14C 05A ( 90) KeDelayExecutionThread + F 82000784 8284E13C 143 ( 323) RtlUnicodeToMultiByteN + F 82000788 8284E12C 0E4 ( 228) NtQueryDirectoryFile + F 8200078C 8284E10C 019 ( 25) ExTerminateThread + F 82000790 8284E0FC 09B ( 155) KeSetCurrentStackPointers + F 82000794 8284E0EC 197 ( 407) XexGetProcedureAddress + F 82000798 8284E0DC 03C ( 60) !! IoDismountVolumeByFileHandle + F 8200079C 8284E0CC 0D9 ( 217) NtDeviceIoControlFile + F 820007A0 8284E0BC 028 ( 40) HalReturnToFirmware + F 820007A4 8284E0AC 003 ( 3) DbgPrint + F 820007A8 8284E09C 140 ( 320) RtlTimeToTimeFields + F 820007AC 8284E08C 0FE ( 254) NtWaitForMultipleObjectsEx + F 820007B0 8284E07C 0F3 ( 243) NtReleaseSemaphore + F 820007B4 8284E06C 0D5 ( 213) NtCreateSemaphore + F 820007B8 8284E05C 084 ( 132) KeQuerySystemTime + F 820007BC 8284E04C 0E8 ( 232) NtQueryInformationFile + F 820007C0 8284E03C 0F7 ( 247) NtSetInformationFile + F 820007C4 8284E02C 0FD ( 253) NtWaitForSingleObjectEx + F 820007C8 8284E01C 0CE ( 206) NtClearEvent + F 820007CC 8284E00C 0F5 ( 245) NtResumeThread + V 820007D0 0AD ( 173) KeTimeStampBundle + F 820007D4 8284DFFC 010 ( 16) ExGetXConfigSetting + V 820007D8 059 ( 89) KeDebugMonitorData + F 820007DC 8284DFEC 097 ( 151) KeSetAffinityThread + F 820007E0 8284DFDC 0FC ( 252) NtSuspendThread + F 820007E4 8284DFCC 081 ( 129) KeQueryBasePriorityThread + V 820007E8 01B ( 27) ExThreadObjectType + F 820007EC 8284DFBC 110 ( 272) ObReferenceObjectByHandle + F 820007F0 8284DFAC 099 ( 153) KeSetBasePriorityThread + F 820007F4 8284DF9C 10B ( 267) ObLookupThreadByThreadId + F 820007F8 8284DF8C 10E ( 270) ObOpenObjectByPointer + F 820007FC 8284DF7C 0DA ( 218) NtDuplicateObject + F 82000800 8284DF6C 101 ( 257) NtYieldExecution + F 82000804 8284DF5C 0F6 ( 246) NtSetEvent + F 82000808 8284DF4C 052 ( 82) KeBugCheck + F 8200080C 8284DF3C 0BC ( 188) MmDeleteKernelStack + F 82000810 8284DF2C 0BB ( 187) MmCreateKernelStack + F 82000814 8284DF1C 0D1 ( 209) NtCreateEvent + F 82000818 8284DF0C 135 ( 309) RtlNtStatusToDosError + F 8200081C 8284DEFC 194 ( 404) XexCheckExecutablePrivilege + F 82000820 8284DEEC 05F ( 95) KeEnterCriticalRegion + F 82000824 8284DEDC 07D ( 125) KeLeaveCriticalRegion + F 82000828 8284DECC 0CC ( 204) NtAllocateVirtualMemory + F 8200082C 8284DEBC 259 ( 601) !! StfsCreateDevice + F 82000830 8284DEAC 103 ( 259) ObCreateSymbolicLink + F 82000834 8284DE9C 25A ( 602) !! StfsControlDevice + F 82000838 8284DE8C 0DB ( 219) NtFlushBuffersFile + F 8200083C 8284DE7C 104 ( 260) ObDeleteSymbolicLink + F 82000840 8284DE6C 105 ( 261) ObDereferenceObject + F 82000844 8284DE5C 0DC ( 220) NtFreeVirtualMemory + F 82000848 8284DE4C 0D2 ( 210) NtCreateFile + F 8200084C 8284DE3C 256 ( 598) XeKeysConsolePrivateKeySign + F 82000850 8284DE2C 0F0 ( 240) NtReadFile + F 82000854 8284DE1C 0FF ( 255) NtWriteFile + F 82000858 8284DE0C 192 ( 402) XeCryptSha + F 8200085C 8284DDFC 257 ( 599) !! XeKeysConsoleSignatureVerification + F 82000860 8284DDEC 015 ( 21) ExRegisterTitleTerminateNotification + F 82000864 8284DDDC 09D ( 157) KeSetEvent + F 82000868 8284DDCC 0B0 ( 176) KeWaitForSingleObject + F 8200086C 8284DDBC 08F ( 143) KeResetEvent + V 82000870 193 ( 403) XexExecutableModuleHandle + F 82000874 8284DDAC 12B ( 299) RtlImageXexHeaderField + F 82000878 8284DD9C 1A5 ( 421) !! __C_specific_handler + F 8200087C 8284DD8C 12C ( 300) RtlInitAnsiString + F 82000880 8284DD7C 0DF ( 223) NtOpenFile + F 82000884 8284DD6C 0CF ( 207) NtClose + F 82000888 8284DD5C 0EF ( 239) NtQueryVolumeInformationFile + F 8200088C 8284DD4C 0C4 ( 196) MmQueryAddressProtect + F 82000890 8284DD3C 0BD ( 189) MmFreePhysicalMemory + F 82000894 8284DD2C 0BA ( 186) MmAllocatePhysicalMemoryEx + F 82000898 8284DD1C 12E ( 302) RtlInitializeCriticalSection + F 8200089C 8284DD0C 130 ( 304) RtlLeaveCriticalSection + F 820008A0 8284DCFC 125 ( 293) RtlEnterCriticalSection + F 820008A4 8284DCEC 12F ( 303) RtlInitializeCriticalSectionAndSpinCount + F 820008A8 8284E11C 00D ( 13) ExCreateThread + F 820008AC 8284E47C 085 ( 133) KeRaiseIrqlToDpcLevel + F 820008B0 8284E48C 0B3 ( 179) KfLowerIrql + F 820008B4 8284E49C 088 ( 136) KeReleaseSemaphore + F 820008B8 8284E4AC 1F8 ( 504) XAudioGetVoiceCategoryVolume + F 820008BC 8284E4BC 1F7 ( 503) XAudioGetVoiceCategoryVolumeChangeMask + F 820008C0 8284E4CC 0AF ( 175) KeWaitForMultipleObjects + F 820008C4 8284E4DC 092 ( 146) KeResumeThread + F 820008C8 8284E4EC 074 ( 116) KeInitializeSemaphore + F 820008CC 8284E4FC 226 ( 550) XMAReleaseContext + F 820008D0 8284E50C 224 ( 548) XMACreateContext + F 820008D4 8284E51C 083 ( 131) KeQueryPerformanceFrequency + F 820008D8 8284E52C 141 ( 321) RtlTryEnterCriticalSection + F 820008DC 8284E53C 0AE ( 174) KeTryToAcquireSpinLockAtRaisedIrql + F 820008E0 8284E54C 1F3 ( 499) XAudioRegisterRenderDriverClient + F 820008E4 8284E55C 1F4 ( 500) XAudioUnregisterRenderDriverClient + F 820008E8 8284E56C 1F5 ( 501) XAudioSubmitRenderDriverFrame + F 820008EC 8284E57C 195 ( 405) XexGetModuleHandle + F 820008F0 8284E58C 147 ( 327) !! RtlUnwind + F 820008F4 8284E59C 152 ( 338) KeTlsAlloc + F 820008F8 8284E5AC 154 ( 340) KeTlsGetValue + F 820008FC 8284E5BC 155 ( 341) KeTlsSetValue + F 82000900 8284E5CC 153 ( 339) KeTlsFree + F 82000904 8284E5DC 119 ( 281) !! RtlCaptureContext + F 82000908 8284E5EC 05D ( 93) KeEnableFpuExceptions + F 8200090C 8284E5FC 0C6 ( 198) MmQueryStatistics + F 82000910 8284E60C 0D7 ( 215) NtCreateTimer + F 82000914 8284E61C 0FA ( 250) NtSetTimerEx + F 82000918 8284E62C 0CD ( 205) NtCancelTimer + F 8200091C 8284E63C 0E7 ( 231) NtQueryFullAttributesFile + F 82000920 8284E64C 127 ( 295) RtlFreeAnsiString + F 82000924 8284E65C 142 ( 322) RtlUnicodeStringToAnsiString + F 82000928 8284E66C 12D ( 301) RtlInitUnicodeString + F 8200092C 8284E67C 133 ( 307) RtlMultiByteToUnicodeN + F 82000930 8284E68C 001 ( 1) DbgBreakPoint + +w> 000000D4 GameDatabase: Title doesn't contain XLAST data! Multiplayer functionality might be limited. +i> 000000D4 Title name: PROJECT SYLPHEED +i> 000000D4 +-------------------- ACHIEVEMENTS -------------------- ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| ID | Title | Description | Type | Gamerscore | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 1 | Space Combat Award | Received after your first space battle in the Glasner Training Area. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 2 | Schlos Base Defense Award | Received for stopping the missile attack on Schlos Base. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 3 | Aegis of the People Medal | Received for escorting all 7 refugee ships to safety. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 4 | TCAF Luna Medal | Received for bravely helping the fleet escape during the invasion of the Matisse System. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 5 | TCAF Mars Medal | Received for bravery beyond the call of duty during the escape from the Matisse System. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 6 | Soldier's Charm Amulet | Given to you by Raymond as a token of his trust. | Event | 50 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 7 | White Griffons Patch | Received by the commander and pilots of the White Griffon Squadron when it is formed. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 8 | TCAF Jupiter Medal | Received for bravery during the enemy's attack on the Alberti System. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 9 | Furious Pursuit Badge | Received for continuing attacks on the enemy and shooting down a large number of ships. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 10 | Solo Aerospace Combat Award | Received for descending into Acheron's atmosphere and engaging in combat alone. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 11 | Operation Nebula Blaze Award | Received for completing the extremely hazardous Operation Nebula Blaze. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 12 | Guilty Roses Patch | Received for repelling the Guilty Roses Squadron. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 13 | Super Battleship Slayer Patch | Received for shooting down the second S battleship. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 14 | TCAF Terra Medal | Received for shielding the fleet and seeing that all ships safely fled the Ingres System. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 15 | Hellfires Patch | Received for repelling the enemy Hellfire Squadron. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 16 | Night Ravens Patch | Received for challenging and eradicating the Night Raven Squadron. | Event | 50 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 17 | Solar System Defense Award | Received for great achievements during the campaign to defend the Solar System. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 18 | Special Operations Medal | Received for heroically destroying the Prometheus Driver. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 19 | 1,000 Units Destroyed Medal | Received for shooting down 1,000 enemy fighters and attackers in combat. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 20 | 10,000 Units Destroyed Medal | Received for shooting down 10,000 enemy fighters and attackers in combat. | Event | 70 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 21 | Ship Hunter Award | Received for shooting down 100 enemy warships in combat. | Event | 50 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 22 | Gigaton Club Patch | Received for shooting down enemy vessels with a total weight of one gigaton. | Event | 70 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 23 | Weapon Lord Patch | Received after you collect all usable equipment for the Delta Saber. | Event | 80 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 24 | TCAF Pilot's Commendation | Commemmorates you as one of the greatest pilots in history. | Event | 100 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +i> 000000D4 +-------------------- PROPERTIES -------------------- ++----------+------------------+-------------+-----------+ +| ID | Name | Matchmaking | Data Size | ++----------+------------------+-------------+-----------+ +| 10000006 | Killed Aircrafts | False | 4 | ++----------+------------------+-------------+-----------+ +| 10000008 | Equipments | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000000A | Clear Time | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000000B | Killed Warships | False | 4 | ++----------+------------------+-------------+-----------+ +| 10008001 | Rank | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000800A | | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000800B | | False | 4 | ++----------+------------------+-------------+-----------+ +| 20000005 | Killed Weight | False | 8 | ++----------+------------------+-------------+-----------+ +| 20000007 | Clear Time | False | 8 | ++----------+------------------+-------------+-----------+ +| 20000009 | Earned Points | False | 8 | ++----------+------------------+-------------+-----------+ +| 40008002 | Gamer Name | False | 2 | ++----------+------------------+-------------+-----------+ +i> 000000D4 +-------------------- CONTEXTS -------------------- ++----------+-------------+-------------+---------------+-----------+ +| ID | Name | Matchmaking | Default Value | Max Value | ++----------+-------------+-------------+---------------+-----------+ +| 00000000 | Game Stage | False | 0 | 28 | ++----------+-------------+-------------+---------------+-----------+ +| 00000001 | Game Status | False | 0 | 9 | ++----------+-------------+-------------+---------------+-----------+ +| 00008001 | | False | 0 | 0 | ++----------+-------------+-------------+---------------+-----------+ +| 0000800A | Game Type | True | 0 | 1 | ++----------+-------------+-------------+---------------+-----------+ +| 0000800B | | True | 0 | 0 | ++----------+-------------+-------------+---------------+-----------+ +i> 000000D4 +-------------------- STATS VIEWS -------------------- ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| ID | View Type | Name | Skilled | Arbitrated | Hidden | Team View | Online Only | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000001 | Leaderboard | Time Attack (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000002 | Leaderboard | Score Attack (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000003 | Leaderboard | Extra 1 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000004 | Leaderboard | Extra 1 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000005 | Leaderboard | Extra 2 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000006 | Leaderboard | Extra 2 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000007 | Leaderboard | Extra 3 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000008 | Leaderboard | Extra 3 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000009 | Leaderboard | Extra 4 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 0000000A | Leaderboard | Extra 4 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 0000000C | Leaderboard | Time Attack (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 0000000D | Leaderboard | Score Attack (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| FFFF0000 | Leaderboard | | True | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +i> 000000D4 +-------------------- PRESENCE MODES -------------------- ++---------------+----------------+------------------+ +| Context Value | Contexts Count | Properties Count | ++---------------+----------------+------------------+ +| 0 | 2 | 0 | ++---------------+----------------+------------------+ +i> 000000D4 XThread01000020 (5) Stack: 70110000-70130000 +i> 000000D4 KernelState: Launching module... +i> 000000D4 XThreadF8000008 (6) Stack: 70150000-701D0000 +K> 01000020 XThread::Execute thid 5 (handle=01000020, 'Kernel Dispatch (01000020)', native=00000190, ) +i> 01000010 Loaded 7 shaders from storage +i> 01000010 Loaded 4 pipeline descriptions, 8 shader translations needed +K> F8000008 XThread::Execute thid 6 (handle=F8000008, 'Main XThread (F8000008)', native=00000194) +i> 01000010 Translated 7 shaders in 3 ms +i> 01000010 Pipeline cache loaded: 4 created, 0 already exist, 4 total stored +i> 01000010 Pipeline creation took 0 milliseconds +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800000C type=1 initial_state=0 lr=824A9F6C +F> F8000008 NullDevice::ResolvePath() +F> F8000008 NullDevice::ResolvePath() +F> F8000008 NullDevice::ResolvePath() +!> F8000008 undefined extern call to 8284E0DC IoDismountVolumeByFileHandle +F> F8000008 NullDevice::ResolvePath() +i> F8000008 Got xam task args: v1 = 02080002, v2 = 00000000 +i> F8000008 XThreadF8000010 (7) Stack: 701F0000-70270000 +K> F8000010 XThread::Execute thid 7 (handle=F8000010, 'XThread01B8 (F8000010)', native=000001B8) +F> F8000010 NullDevice::ResolvePath() +w> F8000010 Game is attempting to allocate devkit debug memory (base: 00000000, size: 000FF000). Ignoring debug flag and using normal allocation. +!> F8000010 undefined extern call to 8284DEBC StfsCreateDevice +K> F8000010 AUDIT-HLC KeSetEvent guest_ptr=8287094C lr=824A95D0 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000020 type=1 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000024 (8) Stack: 70290000-702B0000 +K> F8000024 XThread::Execute thid 8 (handle=F8000024, 'XThread01BC (F8000024)', native=000001BC) +K> F8000024 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000020 alertable=0 lr=824AC578 guest_lr=824AFFC4 +F> F8000008 HostPathDevice::ResolvePath() +i> F8000008 XThreadF800002C (9) Stack: 702D0000-702E0000 +K> F800002C XThread::Execute thid 9 (handle=F800002C, 'XThread01C0 (F800002C)', native=000001C0) +F> F800002C HostPathDevice::ResolvePath() +F> F800002C HostPathDevice::ResolvePath() +F> F8000008 HostPathDevice::ResolvePath(\d4ea4615\e\46ee8ca) +F> F8000008 HostPathDevice::ResolvePath(\d4ea4615\e) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800003C type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000040 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000048 (A) Stack: 70300000-70340000 +K> F8000048 XThread::Execute thid 10 (handle=F8000048, 'XThread01C4 (F8000048)', native=000001C4) +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800003C alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000050 type=0 initial_state=0 lr=824A9F6C +!> F800002C BaseHeap::Release failed because address is not a region start +!> F800002C PhysicalHeap::Release failed due to parent heap failure +F> F800002C HostPathDevice::ResolvePath() +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +F> F800002C HostPathDevice::ResolvePath() +K> F8000048 AUDIT-HLC NtSetEvent handle=F800004C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800003C result=00000000 lr=824AC578 guest_lr=82452E64 +!> F800002C BaseHeap::Release failed because address is not a region start +!> F800002C PhysicalHeap::Release failed due to parent heap failure +K> F800002C AUDIT-HLC NtWaitForSingleObjectEx handle=F8000028 alertable=0 lr=824AC578 guest_lr=824AFFC4 +!> F8000008 BaseHeap::Release failed because address is not a region start +!> F8000008 PhysicalHeap::Release failed due to parent heap failure +!> F8000008 BaseHeap::Release failed because address is not a region start +!> F8000008 PhysicalHeap::Release failed due to parent heap failure +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\8\3421153) +F> F8000008 DiscImageDevice::ResolvePath(\dat) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\355f2f8) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000038 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800004C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800004C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000050 type=0 initial_state=0 lr=824A9F6C +i> F8000048 XThreadF8000058 (B) Stack: 70360000-70370000 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F800004C alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 XThread::Execute thid 11 (handle=F8000058, 'XThread01C8 (F8000058)', native=000001C8) +K> F8000058 AUDIT-HLC NtSetEvent handle=F800004C lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800004C result=00000000 lr=824AC578 guest_lr=8245148C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F800003C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=82452E64 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000038 type=1 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF800004C (C) Stack: 70390000-703A0000 +K> F800004C XThread::Execute thid 12 (handle=F800004C, 'XThread01CC (F800004C)', native=000001CC) +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +i> F8000008 Hardware scaler: width ratio 1:1, height ratio 1:1, final aspect ratio 16:9 +i> 01000010 Selecting rep movs vastcpy. +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000060 type=1 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000064 type=1 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000068 (D) Stack: 703C0000-70440000 +K> F8000068 XThread::Execute thid 13 (handle=F8000068, 'XThread01D0 (F8000068)', native=000001D0) +F> F8000008 HostPathDevice::ResolvePath(\aab216c3\a\2c8c185) +F> F8000008 HostPathDevice::ResolvePath(\aab216c3\a) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000070 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000070 alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000078 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 AUDIT-HLC NtSetEvent handle=F8000078 lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000078 result=00000000 lr=824AC578 guest_lr=8245148C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000074 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000070 result=00000000 lr=824AC578 guest_lr=82452E64 +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\73a5c0a) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000070 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000070 alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000078 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 AUDIT-HLC NtSetEvent handle=F8000078 lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000078 result=00000000 lr=824AC578 guest_lr=8245148C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000074 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000070 result=00000000 lr=824AC578 guest_lr=82452E64 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +i> F8000008 XThreadF8000070 (E) Stack: 70460000-704E0000 +i> F8000008 XThreadF8000074 (F) Stack: 70500000-70580000 +K> F8000070 XThread::Execute thid 14 (handle=F8000070, 'XThread01D4 (F8000070)', native=000001D4) +K> F8000074 XThread::Execute thid 15 (handle=F8000074, 'XThread01D8 (F8000074)', native=000001D8) +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +i> F8000008 AudioSystem::RegisterClient: driver created for index=0, driver=0x70c389000040 +i> F8000008 AudioSystem::RegisterClient: client 0 registered successfully +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000088 type=0 initial_state=0 lr=824A9F6C +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\39a9dcc) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000088 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000090 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000088 result=00000000 lr=824AC578 guest_lr=8245FA10 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000088 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +F> F8000008 DiscImageDevice::ResolvePath(\dat) +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000090 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000088 alertable=0 lr=824AC578 guest_lr=82460150 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000088 result=00000000 lr=824AC578 guest_lr=82460150 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000088 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000088 alertable=0 lr=824AC578 guest_lr=82179148 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000090 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000088 result=00000000 lr=824AC578 guest_lr=82179148 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +i> F8000008 XThreadF8000088 (10) Stack: 705A0000-705B0000 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000088 XThread::Execute thid 16 (handle=F8000088, 'XThread01EC (F8000088)', native=000001EC) +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000090 alertable=0 lr=824AC578 guest_lr=82173BD4 +K> F8000068 AUDIT-HLC NtSetEvent handle=F8000090 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000090 result=00000000 lr=824AC578 guest_lr=82173BD4 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000094 (11) Stack: 705D0000-70650000 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000094 alertable=0 lr=824AC578 guest_lr=822F1B50 +K> F8000094 XThread::Execute thid 17 (handle=F8000094, 'XThread01F0 (F8000094)', native=000001F0) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000094 AUDIT-HLC NtCreateEvent handle=F8000098 type=1 initial_state=1 lr=824A9F6C +K> F8000094 AUDIT-HLC NtCreateEvent handle=F800009C type=0 initial_state=0 lr=824A9F6C +F> F8000094 HostPathDevice::ResolvePath(\aab216c3\5\ee70e0a) +F> F8000094 HostPathDevice::ResolvePath(\aab216c3\5) +K> F8000094 AUDIT-HLC NtWaitForSingleObjectEx handle=F800009C alertable=0 lr=824AC578 guest_lr=821CBAE0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A8 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 AUDIT-HLC NtSetEvent handle=F80000A8 lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000A8 result=00000000 lr=824AC578 guest_lr=8245148C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000A4 lr=824AA304 +K> F8000094 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800009C result=00000000 lr=824AC578 guest_lr=821CBAE0 +i> F8000094 XThreadF800009C (12) Stack: 70670000-70680000 +K> F800009C XThread::Execute thid 18 (handle=F800009C, 'XThread01F4 (F800009C)', native=000001F4) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +i> F800009C XThreadF80000A4 (13) Stack: 706A0000-706D0000 +i> F800009C XThreadF80000A8 (14) Stack: 706F0000-70720000 +K> F80000A4 XThread::Execute thid 19 (handle=F80000A4, 'XThread01F8 (F80000A4)', native=000001F8) +K> F80000A8 XThread::Execute thid 20 (handle=F80000A8, 'XThread01FC (F80000A8)', native=000001FC) +K> F80000A8 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A0 alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F80000A4 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A0 alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000094 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +F> F8000094 HostPathDevice::ResolvePath(\87719002\c\dba806e) +F> F8000094 HostPathDevice::ResolvePath(\87719002\c) +K> F8000094 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +F> F8000094 HostPathDevice::ResolvePath(\87719002\c\ec0a96e) +F> F8000094 HostPathDevice::ResolvePath(\87719002\c) +K> F8000094 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +F> F8000094 HostPathDevice::ResolvePath(\87719002\a\60fcb85) +F> F8000094 HostPathDevice::ResolvePath(\87719002\a) +K> F8000094 AUDIT-HLC NtCreateEvent handle=F80000D0 type=0 initial_state=0 lr=824A9F6C +F> F800009C DiscImageDevice::ResolvePath(\hidden\Resource3D) +F> F8000094 HostPathDevice::ResolvePath(\87719002\2\85d8849) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +F> F8000094 HostPathDevice::ResolvePath(\87719002\2) +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800009C AUDIT-HLC NtCreateEvent handle=F80000E0 type=1 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=822DFCC8 +K> F8000094 AUDIT-HLC NtCreateEvent handle=F80000E8 type=0 initial_state=0 lr=824A9F6C +F> F8000094 HostPathDevice::ResolvePath(\87719002\a\715f485) +F> F8000094 HostPathDevice::ResolvePath(\87719002\a) +K> F8000094 AUDIT-HLC NtCreateEvent handle=F80000F4 type=0 initial_state=0 lr=824A9F6C +F> F8000094 HostPathDevice::ResolvePath(\87719002\c\f2a8ccd) +F> F8000094 HostPathDevice::ResolvePath(\87719002\c) +K> F8000094 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +F> F8000094 HostPathDevice::ResolvePath(\87719002\0\1a2db9c) +F> F8000094 HostPathDevice::ResolvePath(\87719002\0) +K> F8000094 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E8 alertable=0 lr=824AC578 guest_lr=821C515C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000B4 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000C0 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000CC lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000DC lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000E4 lr=824AA304 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=822DFCC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=822DFE24 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000F0 lr=824AA304 +K> F8000094 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E8 result=00000000 lr=824AC578 guest_lr=821C515C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000FC lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000094 result=00000000 lr=824AC578 guest_lr=822F1B50 +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000108 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000B4 lr=824AA304 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=822DFE24 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=822DFED0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000094 (15) Stack: 705D0000-705E0000 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000094 XThread::Execute thid 21 (handle=F8000094, 'XThread0200 (F8000094)', native=00000200) +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000090 lr=824AA304 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=822DFED0 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000090 type=1 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +i> F8000008 XThreadF80000BC (16) Stack: 70600000-70610000 +K> F80000BC XThread::Execute thid 22 (handle=F80000BC, 'XThread0204 (F80000BC)', native=00000204) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000C8 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C8 alertable=0 lr=824AC578 guest_lr=82172BC8 +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000C8 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C8 result=00000000 lr=824AC578 guest_lr=82172BC8 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F80000BC AUDIT-HLC NtWaitForSingleObjectEx handle=F8000090 alertable=0 lr=824AC578 guest_lr=824AFFC4 +F> F800009C DiscImageDevice::ResolvePath(\hidden\Resource3D) +K> F800009C AUDIT-HLC NtCreateEvent handle=F80000CC type=1 initial_state=0 lr=824A9F6C +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx handle=F80000CC alertable=0 lr=824AC578 guest_lr=822DFCC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D4 lr=824AA304 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000CC result=00000000 lr=824AC578 guest_lr=822DFCC8 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx handle=F80000CC alertable=0 lr=824AC578 guest_lr=822DFE24 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D4 lr=824AA304 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000CC result=00000000 lr=824AC578 guest_lr=822DFE24 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx handle=F80000CC alertable=0 lr=824AC578 guest_lr=822DFED0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000E4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF80000DC (17) Stack: 70630000-70640000 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F80000DC XThread::Execute thid 23 (handle=F80000DC, 'XThread0208 (F80000DC)', native=00000208) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF80000F8 (18) Stack: 70740000-707C0000 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000108 (19) Stack: 707E0000-70860000 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F80000F8 XThread::Execute thid 24 (handle=F80000F8, 'XThread020C (F80000F8)', native=0000020C) +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000108 XThread::Execute thid 25 (handle=F8000108, 'XThread0210 (F8000108)', native=00000210) +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D4 lr=824AA304 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000CC result=00000000 lr=824AC578 guest_lr=822DFED0 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +F> F800009C DiscImageDevice::ResolvePath(\hidden\Resource3D) +K> F800009C AUDIT-HLC NtCreateEvent handle=F80000CC type=1 initial_state=0 lr=824A9F6C +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx handle=F80000CC alertable=0 lr=824AC578 guest_lr=822DFCC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D4 lr=824AA304 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000CC result=00000000 lr=824AC578 guest_lr=822DFCC8 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx handle=F80000CC alertable=0 lr=824AC578 guest_lr=822DFE24 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000AC alertable=0 lr=824AC578 guest_lr=821CC19C +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000AC lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000AC result=00000000 lr=824AC578 guest_lr=821CC19C +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D4 lr=824AA304 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000CC result=00000000 lr=824AC578 guest_lr=822DFE24 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx handle=F80000CC alertable=0 lr=824AC578 guest_lr=822DFED0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000AC lr=824AA304 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000CC result=00000000 lr=824AC578 guest_lr=822DFED0 +F> F800009C HostPathDevice::ResolvePath(\69d8e45c\f\ca5c62e) +K> F800009C AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +F> F800009C HostPathDevice::ResolvePath(\69d8e45c\d\14ba3f8) +F> F800009C HostPathDevice::ResolvePath(\69d8e45c\d) +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx handle=F80000AC alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000CC type=0 initial_state=0 lr=824A9F6C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000CC lr=824AA304 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000AC result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F800009C HostPathDevice::ResolvePath(\69d8e45c\8\14c242d) +K> F800009C AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +F> F800009C HostPathDevice::ResolvePath(\69d8e45c\5\6324af0) +F> F800009C HostPathDevice::ResolvePath(\69d8e45c\5) +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx handle=F80000AC alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000CC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000CC lr=824AA304 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000AC result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F800009C HostPathDevice::ResolvePath(\69d8e45c\d\70a9531) +K> F800009C AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +F> F800009C HostPathDevice::ResolvePath(\69d8e45c\a\c9606f9) +F> F800009C HostPathDevice::ResolvePath(\69d8e45c\a) +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx handle=F80000AC alertable=0 lr=824AC578 guest_lr=8245FA10 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000CC type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000CC lr=824AA304 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000AC result=00000000 lr=824AC578 guest_lr=8245FA10 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +F> F800009C HostPathDevice::ResolvePath(\69d8e45c\7\9f2d535) +K> F800009C AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +F> F800009C HostPathDevice::ResolvePath(\69d8e45c\4\efaecd1) +F> F800009C HostPathDevice::ResolvePath(\69d8e45c\4) +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx handle=F80000AC alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000CC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000CC lr=824AA304 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000AC result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F800009C HostPathDevice::ResolvePath(\69d8e45c\7\0c3bba2) +K> F800009C AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +F> F800009C HostPathDevice::ResolvePath(\69d8e45c\4\59fbfe8) +F> F800009C HostPathDevice::ResolvePath(\69d8e45c\4) +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx handle=F80000AC alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000CC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000CC lr=824AA304 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000AC result=00000000 lr=824AC578 guest_lr=8245FA10 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000098 alertable=0 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000098 result=00000000 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000098 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B8 alertable=0 lr=824AC578 guest_lr=821CC19C +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000B8 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B8 result=00000000 lr=824AC578 guest_lr=821CC19C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000098 alertable=0 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000098 result=00000000 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000098 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF80000CC (1A) Stack: 70880000-70900000 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F80000CC XThread::Execute thid 26 (handle=F80000CC, 'XThread0214 (F80000CC)', native=00000214) +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F80000CC AUDIT-HLC NtCreateEvent handle=F80000D4 type=1 initial_state=1 lr=824A9F6C +K> F80000CC AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +F> F80000CC HostPathDevice::ResolvePath(\aab216c3\5\c10eae6) +F> F80000CC HostPathDevice::ResolvePath(\aab216c3\5) +K> F80000CC AUDIT-HLC NtWaitForSingleObjectEx handle=F8000104 alertable=0 lr=824AC578 guest_lr=821CBAE0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000114 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 AUDIT-HLC NtSetEvent handle=F8000114 lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000114 result=00000000 lr=824AC578 guest_lr=8245148C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000110 lr=824AA304 +K> F80000CC AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000104 result=00000000 lr=824AC578 guest_lr=821CBAE0 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000088 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +F> F8000088 DiscImageDevice::ResolvePath(\dat) +K> F8000088 AUDIT-HLC NtSetEvent handle=F8000114 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800010C alertable=0 lr=824AC578 guest_lr=82460150 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800010C result=00000000 lr=824AC578 guest_lr=82460150 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B8 alertable=0 lr=824AC578 guest_lr=82172BC8 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000B8 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B8 result=00000000 lr=824AC578 guest_lr=82172BC8 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +F> F8000008 DiscImageDevice::ResolvePath(\dat\movie) +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000118 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800011C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000120 type=0 initial_state=1 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000124 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000128 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800012C type=0 initial_state=1 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +F> F8000008 DiscImageDevice::ResolvePath(\dat\movie) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000134 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000138 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800013C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000140 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000144 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000148 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800014C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000150 type=0 initial_state=1 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +i> F8000008 XThreadF8000154 (1B) Stack: 70880000-70890000 +i> F8000008 XThreadF8000158 (1C) Stack: 708B0000-708C0000 +i> F8000008 XThreadF800015C (1D) Stack: 708E0000-708F0000 +i> F8000008 XThreadF8000160 (1E) Stack: 70910000-70920000 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25404 lr=82507ABC +K> F8000154 XThread::Execute thid 27 (handle=F8000154, 'XThread0218 (F8000154)', native=00000218) +K> F8000158 XThread::Execute thid 28 (handle=F8000158, 'XThread021C (F8000158)', native=0000021C) +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C XThread::Execute thid 29 (handle=F800015C, 'XThread0220 (F800015C)', native=00000220) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 diff --git a/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.log.sub821B55D8 b/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.log.sub821B55D8 new file mode 100644 index 0000000..82d06e7 --- /dev/null +++ b/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.log.sub821B55D8 @@ -0,0 +1,36551 @@ +i> 000000D8 Build: canary_experimental@99fd19d02 on Jun 5 2026 +i> 000000D8 Storage root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug +i> 000000D8 ----------- CONFIG DUMP ----------- + +[APU] +apu = "any" +apu_max_queued_frames = 8 +enable_xmp = true +ffmpeg_verbose = false +mute = false +use_dedicated_xma_thread = true +xma_decoder = "new" + +[Auditing] +audit_handle_lifecycle = true +audit_jit_prolog_pc = 2182829528 + +[CPU] +break_condition_gpr = -1 +break_condition_op = "eq" +break_condition_truncate = true +break_condition_value = 0 +break_on_debugbreak = true +break_on_instruction = 0 +break_on_start = false +break_on_unimplemented_instructions = true +clock_no_scaling = false +clock_source_raw = false +cpu = "any" +debug_symbol_loader = false +debugprint_trap_log = false +disable_context_promotion = false +disable_instruction_infocache = false +disable_prefetch_and_cachecontrol = true +disassemble_functions = false +dump_translated_hir_functions = false +elide_e0_check = false +emit_inline_mmio_checks = false +emit_mmio_aware_stores_for_recorded_exception_addresses = true +emit_source_annotations = false +enable_early_precompilation = false +full_optimization_even_with_debug = false +ignore_trap_instructions = true +ignore_undefined_externs = true +inline_loadclock = false +inline_mmio_access = true +load_module_map = "" +no_reserved_ops = false +no_round_to_single = false +permit_float_constant_evaluation = false +pvr = 7407360 +record_mmio_access_exceptions = true +store_all_context_values = false +trace_function_coverage = false +trace_function_data = false +trace_function_data_path = "" +trace_function_references = false +trace_functions = false +use_fast_dot_product = false +validate_hir = false +writable_code_segments = false + +[Config] +defaults_date = 2026040912 + +[Content] +license_mask = 0 + +[D3D12] +d3d12_adapter = -1 +d3d12_allow_variable_refresh_rate_and_tearing = true +d3d12_bindless = true +d3d12_break_on_error = false +d3d12_break_on_warning = false +d3d12_debug = false +d3d12_dxbc_disasm = false +d3d12_dxbc_disasm_dxilconv = false +d3d12_pipeline_creation_threads = -1 +d3d12_queue_priority = 1 +d3d12_submit_on_primary_buffer_end = true +d3d12_tessellation_wireframe = false + +[Display] +fullscreen = false +host_present_from_non_ui_thread = true +postprocess_antialiasing = "" +postprocess_dither = true +postprocess_ffx_cas_additional_sharpness = 0 +postprocess_ffx_fsr_max_upsampling_passes = 4 +postprocess_ffx_fsr_sharpness_reduction = 0.20000000298023224 +postprocess_scaling_and_sharpening = "" +present_letterbox = true +present_render_pass_clear = true +present_safe_area_x = 100 +present_safe_area_y = 100 + +[GPU] +anisotropic_override = -1 +async_shader_compilation = true +clear_memory_page_state = false +depth_float24_convert_in_pixel_shader = false +depth_float24_round = false +depth_transfer_not_equal_test = true +disassemble_pm4 = false +draw_resolution_scale_x = 1 +draw_resolution_scale_y = 1 +draw_resolution_scaled_texture_offsets = true +dump_shaders = "" +dxbc_source_map = false +dxbc_switch = true +execute_unclipped_draw_vs_on_cpu = true +execute_unclipped_draw_vs_on_cpu_for_psi_render_backend = true +execute_unclipped_draw_vs_on_cpu_with_scissor = false +force_convert_line_loops_to_strips = false +force_convert_quad_lists_to_triangle_lists = false +force_convert_triangle_fans_to_lists = false +framerate_limit = 0 +gamma_render_target_as_unorm16 = true +gpu = "any" +gpu_3d_to_2d_texture = true +gpu_allow_invalid_fetch_constants = true +gpu_allow_invalid_upload_range = false +half_pixel_offset = true +ignore_32bit_vertex_index_support = false +log_guest_driven_gpu_register_written_values = false +log_ringbuffer_kickoff_initiator_bts = false +mrt_edram_used_range_clamp_to_min = true +native_2x_msaa = true +native_stencil_value_output = true +native_stencil_value_output_d3d12_intel = false +no_discard_stencil_in_transfer_pipelines = false +non_seamless_cube_map = true +occlusion_query = "fast" +occlusion_query_fake_lower_threshold = 80 +occlusion_query_fake_upper_threshold = 100 +occlusion_query_querybatch_range = 0 +occlusion_query_saturation = 1 +primitive_processor_cache_min_indices = 4096 +readback_memexport = false +readback_resolve = "none" +render_target_path_d3d12 = "" +render_target_path_vulkan = "" +resolve_resolution_scale_fill_half_pixel_offset = true +snorm16_render_target_full_range = true +store_shaders = true +target_trace_file = "" +texture_cache_memory_limit_hard = 768 +texture_cache_memory_limit_render_to_texture = 24 +texture_cache_memory_limit_soft = 384 +texture_cache_memory_limit_soft_lifetime = 30 +tiled_shared_memory = true +trace_dump_path = "" +trace_gpu_prefix = "scratch/gpu/" +trace_gpu_stream = false +use_fuzzy_alpha_epsilon = false +vsync = true + +[General] +allow_game_relative_writes = false +allow_plugins = false +apply_patches = true +controller_hotkeys = false +debug = false +disable_doubleclick_fullscreen = false +discord = true +launch_module = "" +notification_sound_path = "" +priority_class = 0 +recent_titles_entry_amount = 10 +time_scalar = 1 + +[HACKS] +ac6_ground_fix = false + +[HID] +guide_button = true +hid = "any" +keyboard_mode = 0 +keyboard_user_index = 0 +left_stick_deadzone_percentage = 0 +right_stick_deadzone_percentage = 0 +vibration = true + +[HID.WinKey] +keybind_a = "0xBA" +keybind_b = "0xDE" +keybind_back = "Z" +keybind_dpad_down = "^S" +keybind_dpad_left = "^A" +keybind_dpad_right = "^D" +keybind_dpad_up = "^W" +keybind_guide = "0x08" +keybind_left_shoulder = "1" +keybind_left_thumb = "F" +keybind_left_thumb_down = "_S" +keybind_left_thumb_left = "_A" +keybind_left_thumb_right = "_D" +keybind_left_thumb_up = "_W" +keybind_left_trigger = "Q I" +keybind_right_shoulder = "3" +keybind_right_thumb = "K" +keybind_right_thumb_down = "0x28" +keybind_right_thumb_left = "0x25" +keybind_right_thumb_right = "0x27" +keybind_right_thumb_up = "0x26" +keybind_right_trigger = "E O" +keybind_start = "X" +keybind_x = "L" +keybind_y = "P" + +[Kernel] +allow_avatar_initialization = false +allow_incompatible_title_update = true +apply_title_update = true +cl = "" +console_type = 0 +default_achievements_backend = "GPD" +ignore_thread_affinities = true +ignore_thread_priorities = false +kernel_build_version = 1888 +kernel_cert_monitor = false +kernel_debug_monitor = false +kernel_display_gamma_power = 2.22222233 +kernel_display_gamma_type = 2 +kernel_pix = false +staging_mode = false + +[Logging] +enable_console = false +flush_log = true +log_file = "" +log_high_frequency_kernel_calls = false +log_level = 2 +log_mask = 0 +log_string_format_kernel_calls = false +log_to_debugprint = false +log_to_stdout = true + +[Memory] +ignore_offset_for_ranged_allocations = false +protect_on_release = false +protect_zero = true +scribble_heap = false +scribble_heap_value = 0 +writable_executable_memory = true + +[Profiles] +logged_profile_slot_0_xuid = "" +logged_profile_slot_1_xuid = "" +logged_profile_slot_2_xuid = "" +logged_profile_slot_3_xuid = "" + +[SDL] +mappings_file = "gamecontrollerdb.txt" + +[Storage] +cache_root = "" +content_root = "" +force_mount_devkit = false +mount_cache = true +mount_memory_unit = false +mount_scratch = false +storage_root = "" + +[UI] +custom_font_path = "" +font_size = 14 +headless = false +imgui_debug = false +profiler_dpi_scaling = false +show_achievement_notification = false +show_profiler = false +storage_selection_dialog = false +window_size_x = 1280 +window_size_y = 720 + +[Video] +avpack = 8 +custom_internal_display_resolution_x = 0 +custom_internal_display_resolution_y = 0 +enable_3d_mode = false +interlaced = false + +[Vulkan] +vulkan_allow_present_mode_fifo_relaxed = true +vulkan_allow_present_mode_immediate = true +vulkan_allow_present_mode_mailbox = true +vulkan_device = -1 +vulkan_log_debug_messages = true +vulkan_pipeline_creation_threads = -1 +vulkan_semaphore_reuse_workaround = false +vulkan_sparse_shared_memory = true +vulkan_validation = false + +[Win32] +win32_high_resolution_timer = true +win32_mmcss = true + +[x64] +align_all_basic_blocks = 0 +delay_via_maybeyield = false +enable_host_guest_stack_synchronization = true +enable_incorrect_roundingmode_behavior = false +enable_rmw_context_merging = false +instrument_call_times = false +max_stackpoints = 65536 +x64_extension_mask = -1 +xop_arithmetic_right_shifts = false +xop_compares = true +xop_left_shifts = false +xop_right_shifts = false +xop_rotates = false +----------- END OF CONFIG DUMP ---- +i> 000000D8 Loaded config: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\xenia-canary.config.toml +i> 000000D8 Content root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\content +i> 000000D8 Host cache root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\cache_host +w> 000000D8 Unable to load Japanese font; JP characters will be boxes +w> 000000D8 Unable to load Japanese font; JP characters will be boxes +i> 00000128 Setup: Initializing Memory... +i> 00000128 Setup: Initializing Exports... +i> 00000128 Setup: Initializing Processor... +i> 00000128 Setup: Initializing Audio... +i> 00000128 Setup: Initializing Graphics... +i> 00000128 Setup: Initializing HID... +i> 00000128 winkey: "0x08" binds key 0x8 to controller input GUIDE. +i> 00000128 winkey: "^A" binds key 0x41 to controller input DPAD_LEFT. +i> 00000128 winkey: "^D" binds key 0x44 to controller input DPAD_RIGHT. +i> 00000128 winkey: "^S" binds key 0x53 to controller input DPAD_DOWN. +i> 00000128 winkey: "^W" binds key 0x57 to controller input DPAD_UP. +i> 00000128 winkey: "_A" binds key 0x41 to controller input LEFT_THUMB_LEFT. +i> 00000128 winkey: "_D" binds key 0x44 to controller input LEFT_THUMB_RIGHT. +i> 00000128 winkey: "_S" binds key 0x53 to controller input LEFT_THUMB_DOWN. +i> 00000128 winkey: "_W" binds key 0x57 to controller input LEFT_THUMB_UP. +i> 00000128 winkey: "F" binds key 0x46 to controller input LEFT_THUMB_PRESSED. +i> 00000128 winkey: "0x26" binds key 0x26 to controller input RIGHT_THUMB_UP. +i> 00000128 winkey: "0x28" binds key 0x28 to controller input RIGHT_THUMB_DOWN. +i> 00000128 winkey: "0x27" binds key 0x27 to controller input RIGHT_THUMB_RIGHT. +i> 00000128 winkey: "0x25" binds key 0x25 to controller input RIGHT_THUMB_LEFT. +i> 00000128 winkey: "K" binds key 0x4B to controller input RIGHT_THUMB_PRESSED. +i> 00000128 winkey: "L" binds key 0x4C to controller input X. +i> 00000128 winkey: "0xDE" binds key 0xDE to controller input B. +i> 00000128 winkey: "0xBA" binds key 0xBA to controller input A. +i> 00000128 winkey: "P" binds key 0x50 to controller input Y. +i> 00000128 winkey: "Q" binds key 0x51 to controller input LEFT_TRIGGER. +i> 00000128 winkey: "I" binds key 0x49 to controller input LEFT_TRIGGER. +i> 00000128 winkey: "E" binds key 0x45 to controller input RIGHT_TRIGGER. +i> 00000128 winkey: "O" binds key 0x4F to controller input RIGHT_TRIGGER. +i> 00000128 winkey: "Z" binds key 0x5A to controller input BACK. +i> 00000128 winkey: "X" binds key 0x58 to controller input START. +i> 00000128 winkey: "1" binds key 0x31 to controller input LEFT_SHOULDER. +i> 00000128 winkey: "3" binds key 0x33 to controller input RIGHT_SHOULDER. +i> 000000D8 SDL Version 2.32.2 initialized. +w> 000000D8 SDL GameControllerDB: file 'gamecontrollerdb.txt' does not exist. +i> 00000128 Setup: Initializing VFS... +i> 00000128 PatchDB: Loaded patches for 0 titles +i> 00000128 Setup: Initializing Kernel... +i> 00000128 ProfileManager: Found 0 Profiles +w> 00000128 BaseHeap::AllocFixed attempting commit on unreserved page +w> 00000128 BaseHeap::AllocFixed attempting commit on unreserved page +i> 00000128 Setup: Starting graphics_system... +i> 00000128 DXGI adapter: NVIDIA GeForce GTX 1070 Ti (vendor 0x1002, device 0x73DF) +i> 00000128 Direct3D 12 device and OS features: +* Max GPU virtual address bits per resource: 40 +* Non-zeroed heap creation: yes +* Pixel-shader-specified stencil reference: no +* Programmable sample positions: tier 0 +* Rasterizer-ordered views: yes +* Resource binding: tier 3 +* Tiled resources: tier 4 +* Unaligned block-compressed textures: yes +i> 00000128 XThread01000010 (1) Stack: 70010000-70030000 +i> 00000128 XThread01000014 (2) Stack: 70050000-70070000 +i> 00000128 Setup: Starting audio_system... +K> 01000010 XThread::Execute thid 1 (handle=01000010, 'GPU Commands (01000010)', native=00000158, ) +K> 01000014 XThread::Execute thid 2 (handle=01000014, 'GPU Frame limiter (01000014)', native=0000015C, ) +i> 00000128 XThread01000018 (3) Stack: 70090000-700B0000 +i> 00000128 XThread0100001C (4) Stack: 700D0000-700F0000 +K> 01000018 XThread::Execute thid 3 (handle=01000018, 'XMA Decoder (01000018)', native=00000184, ) +K> 0100001C XThread::Execute thid 4 (handle=0100001C, 'Audio Worker (0100001C)', native=00000188, ) +i> 000000D8 Checking for XISO +F> 000000D8 DiscImageDevice::Initialize +i> 000000D8 Checking for XISO +F> 000000D8 DiscImageDevice::Initialize +F> 000000D8 DiscImageDevice::Initialize +i> 000000D8 Loading module GAME:\default.xex +F> 000000D8 DiscImageDevice::ResolvePath(\default.xex) +i> 000000D8 Module \Device\Cdrom0\default.xex: +Module Hash: CCF935D24A74E002 + Module Flags: 00000001 + XEX_MODULE_TITLE +Security Header: + Image Flags: 00000008 + XEX_IMAGE_XGD2_MEDIA_ONLY + Load Address: 82000000 + Image Size: 00920000 + Export Table: 00000000 +Optional Header Count: 15 + XEX_HEADER_RESOURCE_INFO: + 535107D4 828FB900-8291D8CF, 139215b + XEX_HEADER_FILE_FORMAT_INFO: + Info Size: 36 + Encryption Type: Normal + Compression Type: Normal + Window Size: 32768 + Block Size: 61440 + Block Hash: B3 2B D7 D4 EF 96 9A C5 9F D7 77 C6 8A 99 AA 1C BD 87 1C BE 00 90 2E F1 46 3F A3 D7 00 00 00 10 + XEX_HEADER_ENTRY_POINT: 824AB748 + XEX_HEADER_IMAGE_BASE_ADDRESS: 82000000 + XEX_HEADER_IMPORT_LIBRARIES: + xam.xex - 104 imports + Version: 2.0.4552.0 + Min Version: 2.0.4552.0 + xboxkrnl.exe - 294 imports + Version: 2.0.4552.0 + Min Version: 2.0.4552.0 + XEX_HEADER_CHECKSUM_TIMESTAMP: + Checksum : 00902EF1 + Time Stamp: 463FA3D7 - Tue May 8 00:10:31 2007 + XEX_HEADER_ORIGINAL_PE_NAME: default.pe + XEX_HEADER_STATIC_LIBRARIES: + XAPILIB : 2.0.3215.0 + D3D9 : 2.0.3215.1 + D3DX9 : 2.0.3215.0 + XBOXKRNL : 2.0.3215.0 + XAUD : 2.0.3215.0 + LIBCPMT : 2.0.3215.0 + XMP : 2.0.3215.0 + XMEDIA : 2.0.3215.0 + XONLINE : 2.0.3215.0 + XGRAPHC : 2.0.3215.0 + X3DAUD : 2.0.3215.1 + XACT : 2.0.3215.1 + XEX_HEADER_TLS_INFO: + Slot Count: 64 + Raw Data Address: 00000000 + Data Size: 0 + Raw Data Size: 0 + XEX_HEADER_DEFAULT_STACK_SIZE: 524288 + XEX_HEADER_SYSTEM_FLAGS: 00000400 + XEX_SYSTEM_PAL50_INCOMPATIBLE + XEX_HEADER_EXECUTION_INFO: + Media ID: 2D2E2EEB + Title ID: 535107D4 + Savegame ID: 535107D4 + Disc Number / Total: 1 / 1 + XEX_HEADER_GAME_RATINGS: + ESRB: Teen + PEGI: 12+ + PEGI-FI: 11+ + PEGI - PT: 12+ + BBFC: 12+ + CERO: Unrated + USK: Approved for children aged 12 and above + OFLC - AU: Parental Guidance + OFLC - NZ: Parental Guidance + KMRB: Unrated + Brazil: Unrated + FPB: 13+ + XEX_HEADER_LAN_KEY: E0 3C EA 47 3C AE 06 62 98 8F DB 7F 58 50 12 38 + XEX_HEADER_XBOX360_LOGO: + Section Size: 1736 + Logo Size: 1728 +Sections: + 0 RODATA 1 pages 82000000 - 82010000 (65536 bytes) + 1 RODATA 1 pages 82010000 - 82020000 (65536 bytes) + 2 RODATA 1 pages 82020000 - 82030000 (65536 bytes) + 3 RODATA 1 pages 82030000 - 82040000 (65536 bytes) + 4 RODATA 1 pages 82040000 - 82050000 (65536 bytes) + 5 RODATA 1 pages 82050000 - 82060000 (65536 bytes) + 6 RODATA 1 pages 82060000 - 82070000 (65536 bytes) + 7 RODATA 1 pages 82070000 - 82080000 (65536 bytes) + 8 RODATA 1 pages 82080000 - 82090000 (65536 bytes) + 9 RODATA 1 pages 82090000 - 820A0000 (65536 bytes) + 10 RODATA 1 pages 820A0000 - 820B0000 (65536 bytes) + 11 RODATA 1 pages 820B0000 - 820C0000 (65536 bytes) + 12 RODATA 1 pages 820C0000 - 820D0000 (65536 bytes) + 13 RODATA 1 pages 820D0000 - 820E0000 (65536 bytes) + 14 RODATA 1 pages 820E0000 - 820F0000 (65536 bytes) + 15 RODATA 1 pages 820F0000 - 82100000 (65536 bytes) + 16 RODATA 1 pages 82100000 - 82110000 (65536 bytes) + 17 RODATA 1 pages 82110000 - 82120000 (65536 bytes) + 18 RODATA 1 pages 82120000 - 82130000 (65536 bytes) + 19 RODATA 1 pages 82130000 - 82140000 (65536 bytes) + 20 RODATA 1 pages 82140000 - 82150000 (65536 bytes) + 21 CODE 1 pages 82150000 - 82160000 (65536 bytes) + 22 CODE 1 pages 82160000 - 82170000 (65536 bytes) + 23 CODE 1 pages 82170000 - 82180000 (65536 bytes) + 24 CODE 1 pages 82180000 - 82190000 (65536 bytes) + 25 CODE 1 pages 82190000 - 821A0000 (65536 bytes) + 26 CODE 1 pages 821A0000 - 821B0000 (65536 bytes) + 27 CODE 1 pages 821B0000 - 821C0000 (65536 bytes) + 28 CODE 1 pages 821C0000 - 821D0000 (65536 bytes) + 29 CODE 1 pages 821D0000 - 821E0000 (65536 bytes) + 30 CODE 1 pages 821E0000 - 821F0000 (65536 bytes) + 31 CODE 1 pages 821F0000 - 82200000 (65536 bytes) + 32 CODE 1 pages 82200000 - 82210000 (65536 bytes) + 33 CODE 1 pages 82210000 - 82220000 (65536 bytes) + 34 CODE 1 pages 82220000 - 82230000 (65536 bytes) + 35 CODE 1 pages 82230000 - 82240000 (65536 bytes) + 36 CODE 1 pages 82240000 - 82250000 (65536 bytes) + 37 CODE 1 pages 82250000 - 82260000 (65536 bytes) + 38 CODE 1 pages 82260000 - 82270000 (65536 bytes) + 39 CODE 1 pages 82270000 - 82280000 (65536 bytes) + 40 CODE 1 pages 82280000 - 82290000 (65536 bytes) + 41 CODE 1 pages 82290000 - 822A0000 (65536 bytes) + 42 CODE 1 pages 822A0000 - 822B0000 (65536 bytes) + 43 CODE 1 pages 822B0000 - 822C0000 (65536 bytes) + 44 CODE 1 pages 822C0000 - 822D0000 (65536 bytes) + 45 CODE 1 pages 822D0000 - 822E0000 (65536 bytes) + 46 CODE 1 pages 822E0000 - 822F0000 (65536 bytes) + 47 CODE 1 pages 822F0000 - 82300000 (65536 bytes) + 48 CODE 1 pages 82300000 - 82310000 (65536 bytes) + 49 CODE 1 pages 82310000 - 82320000 (65536 bytes) + 50 CODE 1 pages 82320000 - 82330000 (65536 bytes) + 51 CODE 1 pages 82330000 - 82340000 (65536 bytes) + 52 CODE 1 pages 82340000 - 82350000 (65536 bytes) + 53 CODE 1 pages 82350000 - 82360000 (65536 bytes) + 54 CODE 1 pages 82360000 - 82370000 (65536 bytes) + 55 CODE 1 pages 82370000 - 82380000 (65536 bytes) + 56 CODE 1 pages 82380000 - 82390000 (65536 bytes) + 57 CODE 1 pages 82390000 - 823A0000 (65536 bytes) + 58 CODE 1 pages 823A0000 - 823B0000 (65536 bytes) + 59 CODE 1 pages 823B0000 - 823C0000 (65536 bytes) + 60 CODE 1 pages 823C0000 - 823D0000 (65536 bytes) + 61 CODE 1 pages 823D0000 - 823E0000 (65536 bytes) + 62 CODE 1 pages 823E0000 - 823F0000 (65536 bytes) + 63 CODE 1 pages 823F0000 - 82400000 (65536 bytes) + 64 CODE 1 pages 82400000 - 82410000 (65536 bytes) + 65 CODE 1 pages 82410000 - 82420000 (65536 bytes) + 66 CODE 1 pages 82420000 - 82430000 (65536 bytes) + 67 CODE 1 pages 82430000 - 82440000 (65536 bytes) + 68 CODE 1 pages 82440000 - 82450000 (65536 bytes) + 69 CODE 1 pages 82450000 - 82460000 (65536 bytes) + 70 CODE 1 pages 82460000 - 82470000 (65536 bytes) + 71 CODE 1 pages 82470000 - 82480000 (65536 bytes) + 72 CODE 1 pages 82480000 - 82490000 (65536 bytes) + 73 CODE 1 pages 82490000 - 824A0000 (65536 bytes) + 74 CODE 1 pages 824A0000 - 824B0000 (65536 bytes) + 75 CODE 1 pages 824B0000 - 824C0000 (65536 bytes) + 76 CODE 1 pages 824C0000 - 824D0000 (65536 bytes) + 77 CODE 1 pages 824D0000 - 824E0000 (65536 bytes) + 78 CODE 1 pages 824E0000 - 824F0000 (65536 bytes) + 79 CODE 1 pages 824F0000 - 82500000 (65536 bytes) + 80 CODE 1 pages 82500000 - 82510000 (65536 bytes) + 81 CODE 1 pages 82510000 - 82520000 (65536 bytes) + 82 CODE 1 pages 82520000 - 82530000 (65536 bytes) + 83 CODE 1 pages 82530000 - 82540000 (65536 bytes) + 84 CODE 1 pages 82540000 - 82550000 (65536 bytes) + 85 CODE 1 pages 82550000 - 82560000 (65536 bytes) + 86 CODE 1 pages 82560000 - 82570000 (65536 bytes) + 87 CODE 1 pages 82570000 - 82580000 (65536 bytes) + 88 CODE 1 pages 82580000 - 82590000 (65536 bytes) + 89 CODE 1 pages 82590000 - 825A0000 (65536 bytes) + 90 CODE 1 pages 825A0000 - 825B0000 (65536 bytes) + 91 CODE 1 pages 825B0000 - 825C0000 (65536 bytes) + 92 CODE 1 pages 825C0000 - 825D0000 (65536 bytes) + 93 CODE 1 pages 825D0000 - 825E0000 (65536 bytes) + 94 CODE 1 pages 825E0000 - 825F0000 (65536 bytes) + 95 CODE 1 pages 825F0000 - 82600000 (65536 bytes) + 96 CODE 1 pages 82600000 - 82610000 (65536 bytes) + 97 CODE 1 pages 82610000 - 82620000 (65536 bytes) + 98 CODE 1 pages 82620000 - 82630000 (65536 bytes) + 99 CODE 1 pages 82630000 - 82640000 (65536 bytes) + 100 CODE 1 pages 82640000 - 82650000 (65536 bytes) + 101 CODE 1 pages 82650000 - 82660000 (65536 bytes) + 102 CODE 1 pages 82660000 - 82670000 (65536 bytes) + 103 CODE 1 pages 82670000 - 82680000 (65536 bytes) + 104 CODE 1 pages 82680000 - 82690000 (65536 bytes) + 105 CODE 1 pages 82690000 - 826A0000 (65536 bytes) + 106 CODE 1 pages 826A0000 - 826B0000 (65536 bytes) + 107 CODE 1 pages 826B0000 - 826C0000 (65536 bytes) + 108 CODE 1 pages 826C0000 - 826D0000 (65536 bytes) + 109 CODE 1 pages 826D0000 - 826E0000 (65536 bytes) + 110 CODE 1 pages 826E0000 - 826F0000 (65536 bytes) + 111 CODE 1 pages 826F0000 - 82700000 (65536 bytes) + 112 CODE 1 pages 82700000 - 82710000 (65536 bytes) + 113 CODE 1 pages 82710000 - 82720000 (65536 bytes) + 114 CODE 1 pages 82720000 - 82730000 (65536 bytes) + 115 CODE 1 pages 82730000 - 82740000 (65536 bytes) + 116 CODE 1 pages 82740000 - 82750000 (65536 bytes) + 117 CODE 1 pages 82750000 - 82760000 (65536 bytes) + 118 CODE 1 pages 82760000 - 82770000 (65536 bytes) + 119 CODE 1 pages 82770000 - 82780000 (65536 bytes) + 120 CODE 1 pages 82780000 - 82790000 (65536 bytes) + 121 CODE 1 pages 82790000 - 827A0000 (65536 bytes) + 122 CODE 1 pages 827A0000 - 827B0000 (65536 bytes) + 123 CODE 1 pages 827B0000 - 827C0000 (65536 bytes) + 124 CODE 1 pages 827C0000 - 827D0000 (65536 bytes) + 125 CODE 1 pages 827D0000 - 827E0000 (65536 bytes) + 126 CODE 1 pages 827E0000 - 827F0000 (65536 bytes) + 127 CODE 1 pages 827F0000 - 82800000 (65536 bytes) + 128 CODE 1 pages 82800000 - 82810000 (65536 bytes) + 129 CODE 1 pages 82810000 - 82820000 (65536 bytes) + 130 CODE 1 pages 82820000 - 82830000 (65536 bytes) + 131 CODE 1 pages 82830000 - 82840000 (65536 bytes) + 132 CODE 1 pages 82840000 - 82850000 (65536 bytes) + 133 CODE 1 pages 82850000 - 82860000 (65536 bytes) + 134 CODE 1 pages 82860000 - 82870000 (65536 bytes) + 135 RWDATA 1 pages 82870000 - 82880000 (65536 bytes) + 136 RWDATA 1 pages 82880000 - 82890000 (65536 bytes) + 137 RWDATA 1 pages 82890000 - 828A0000 (65536 bytes) + 138 RWDATA 1 pages 828A0000 - 828B0000 (65536 bytes) + 139 RWDATA 1 pages 828B0000 - 828C0000 (65536 bytes) + 140 RWDATA 1 pages 828C0000 - 828D0000 (65536 bytes) + 141 RWDATA 1 pages 828D0000 - 828E0000 (65536 bytes) + 142 RWDATA 1 pages 828E0000 - 828F0000 (65536 bytes) + 143 RWDATA 1 pages 828F0000 - 82900000 (65536 bytes) + 144 RWDATA 1 pages 82900000 - 82910000 (65536 bytes) + 145 RWDATA 1 pages 82910000 - 82920000 (65536 bytes) +Imports: + xam - 52 imports + Version: 0.0.4552.32 + Min Version: 0.0.4552.32 + + Total: 52 + Known: 100% (52 known, 0 unknown) + Implemented: 98% (51 implemented, 1 unimplemented) + + F 82000600 8284DA7C 28C ( 652) XNotifyPositionUI + F 82000604 8284DA8C 2BC ( 700) XamShowSigninUI + F 82000608 8284DA9C 2C1 ( 705) XamShowKeyboardUI + F 8200060C 8284DAAC 2D5 ( 725) !! XamShowGamerCardUIForXUID + F 82000610 8284DABC 2CB ( 715) XamShowDeviceSelectorUI + F 82000614 8284DACC 2D9 ( 729) XamShowDirtyDiscErrorUI + F 82000618 8284DADC 1B3 ( 435) XamTaskShouldExit + F 8200061C 8284DAEC 1B1 ( 433) XamTaskCloseHandle + F 82000620 8284DAFC 1AF ( 431) XamTaskSchedule + F 82000624 8284DB0C 1A4 ( 420) XamLoaderLaunchTitle + F 82000628 8284DB1C 1F7 ( 503) XMsgStartIORequest + F 8200062C 8284DB2C 20E ( 526) XamUserGetName + F 82000630 8284DB3C 210 ( 528) XamUserGetSigninState + F 82000634 8284DB4C 282 ( 642) XamGetSystemVersion + F 82000638 8284DB5C 2F7 ( 759) XamUserCreateStatsEnumerator + F 8200063C 8284DB6C 2EE ( 750) XamUserCreateAchievementEnumerator + F 82000640 8284DB7C 20A ( 522) XamUserGetXUID + F 82000644 8284DB8C 250 ( 592) XamEnumerate + F 82000648 8284DB9C 3CC ( 972) XGetGameRegion + F 8200064C 8284DBAC 190 ( 400) XamInputGetCapabilities + F 82000650 8284DBBC 191 ( 401) XamInputGetState + F 82000654 8284DBCC 192 ( 402) XamInputSetState + F 82000658 8284DBDC 198 ( 408) XamInputGetKeystrokeEx + F 8200065C 8284DBEC 258 ( 600) XamContentCreate + F 82000660 8284DBFC 25B ( 603) XamContentDelete + F 82000664 8284DC0C 25A ( 602) XamContentClose + F 82000668 8284DC1C 260 ( 608) XamContentSetThumbnail + F 8200066C 8284DC2C 262 ( 610) XamContentGetCreator + F 82000670 8284DC3C 25C ( 604) XamContentCreateEnumerator + F 82000674 8284DC4C 265 ( 613) XamContentGetDeviceState + F 82000678 8284DC5C 25E ( 606) XamContentGetDeviceData + F 8200067C 8284DC6C 25F ( 607) XamContentGetDeviceName + F 82000680 8284DC7C 1A0 ( 416) XamEnableInactivityProcessing + F 82000684 8284DC8C 1A1 ( 417) XamResetInactivity + F 82000688 8284DC9C 2DC ( 732) XamShowMessageBoxUIEx + F 8200068C 8284DCAC 3CD ( 973) XGetLanguage + F 82000690 8284DCBC 3CB ( 971) XGetAVPack + F 82000694 8284DCCC 1A9 ( 425) XamLoaderTerminateTitle + F 82000698 8284DCDC 280 ( 640) XamGetExecutionId + F 8200069C 8284E45C 28B ( 651) XNotifyGetNext + F 820006A0 8284E44C 002 ( 2) NetDll_WSACleanup + F 820006A4 8284E43C 001 ( 1) NetDll_WSAStartup + F 820006A8 8284E46C 28A ( 650) XamNotifyCreateListener + F 820006AC 8284E42C 316 ( 790) XamSessionCreateHandle + F 820006B0 8284E41C 317 ( 791) XamSessionRefObjByHandle + F 820006B4 8284E40C 21A ( 538) XamUserWriteProfileSettings + F 820006B8 8284E3FC 219 ( 537) XamUserReadProfileSettings + F 820006BC 8284E3EC 1EA ( 490) XamAlloc + F 820006C0 8284E3DC 1EC ( 492) XamFree + F 820006C4 8284E3CC 3D1 ( 977) XGetVideoMode + F 820006C8 8284E3BC 1F4 ( 500) XMsgInProcessCall + F 820006CC 8284E3AC 1FC ( 508) XMsgStartIORequestEx + + xboxkrnl - 152 imports + Version: 0.0.4552.32 + Min Version: 0.0.4552.32 + + Total: 152 + Known: 100% (152 known, 0 unknown) + Implemented: 95% (145 implemented, 7 unimplemented) + + F 820006D4 8284E1FC 0B4 ( 180) KfReleaseSpinLock + F 820006D8 8284E20C 0B1 ( 177) KfAcquireSpinLock + F 820006DC 8284E21C 1DF ( 479) KiApcNormalRoutineNop + F 820006E0 8284E22C 1B6 ( 438) VdEnableRingBufferRPtrWriteBack + F 820006E4 8284E23C 1C3 ( 451) VdInitializeRingBuffer + F 820006E8 8284E24C 0BE ( 190) MmGetPhysicalAddress + F 820006EC 8284E25C 1D9 ( 473) VdSetSystemCommandBufferGpuIdentifierAddress + F 820006F0 8284E26C 13B ( 315) sprintf + F 820006F4 8284E27C 1B9 ( 441) VdGetCurrentDisplayGamma + V 820006F8 266 ( 614) KeCertMonitorData + F 820006FC 8284E28C 14D ( 333) _vsnprintf + V 82000700 158 ( 344) XboxKrnlVersion + F 82000704 8284E29C 1DC ( 476) VdShutdownEngines + F 82000708 8284E2AC 1CA ( 458) VdQueryVideoMode + F 8200070C 8284E2BC 1BA ( 442) VdGetCurrentDisplayInformation + F 82000710 8284E2CC 1D3 ( 467) VdSetDisplayMode + F 82000714 8284E2DC 1D5 ( 469) VdSetGraphicsInterruptCallback + F 82000718 8284E2EC 1C2 ( 450) VdInitializeEngines + F 8200071C 8284E2FC 1C6 ( 454) VdIsHSIOTrainingSucceeded + F 82000720 8284E30C 1C9 ( 457) VdQueryVideoFlags + F 82000724 8284E31C 1B1 ( 433) VdCallGraphicsNotificationRoutines + V 82000728 1C0 ( 448) VdGpuClockInMHz + F 8200072C 8284E32C 1C5 ( 453) VdInitializeScalerCommandBuffer + F 82000730 8284E33C 269 ( 617) VdRetrainEDRAM + F 82000734 8284E34C 26A ( 618) VdRetrainEDRAMWorker + V 82000738 1C1 ( 449) VdHSIOCalibrationLock + F 8200073C 8284E35C 06B ( 107) KeLockL2 + F 82000740 8284E36C 06C ( 108) KeUnlockL2 + F 82000744 8284E37C 1C7 ( 455) VdPersistDisplay + F 82000748 8284E38C 25B ( 603) VdSwap + F 8200074C 8284E39C 1BD ( 445) VdGetSystemCommandBuffer + V 82000750 1BE ( 446) VdGlobalDevice + F 82000754 8284E1EC 04D ( 77) KeAcquireSpinLockAtRaisedIrql + F 82000758 8284E1DC 089 ( 137) KeReleaseSpinLockFromRaisedIrql + F 8200075C 8284E1CC 1B4 ( 436) VdEnableDisableClockGating + F 82000760 8284E1BC 13F ( 319) RtlTimeFieldsToTime + F 82000764 8284E1AC 136 ( 310) RtlRaiseException + F 82000768 8284E19C 0EE ( 238) NtQueryVirtualMemory + F 8200076C 8284E18C 11B ( 283) RtlCompareMemoryUlong + F 82000770 8284E17C 066 ( 102) KeGetCurrentProcessType + F 82000774 8284E16C 053 ( 83) KeBugCheckEx + F 82000778 8284E15C 126 ( 294) RtlFillMemoryUlong + V 8200077C 1AE ( 430) ExLoadedCommandLine + F 82000780 8284E14C 05A ( 90) KeDelayExecutionThread + F 82000784 8284E13C 143 ( 323) RtlUnicodeToMultiByteN + F 82000788 8284E12C 0E4 ( 228) NtQueryDirectoryFile + F 8200078C 8284E10C 019 ( 25) ExTerminateThread + F 82000790 8284E0FC 09B ( 155) KeSetCurrentStackPointers + F 82000794 8284E0EC 197 ( 407) XexGetProcedureAddress + F 82000798 8284E0DC 03C ( 60) !! IoDismountVolumeByFileHandle + F 8200079C 8284E0CC 0D9 ( 217) NtDeviceIoControlFile + F 820007A0 8284E0BC 028 ( 40) HalReturnToFirmware + F 820007A4 8284E0AC 003 ( 3) DbgPrint + F 820007A8 8284E09C 140 ( 320) RtlTimeToTimeFields + F 820007AC 8284E08C 0FE ( 254) NtWaitForMultipleObjectsEx + F 820007B0 8284E07C 0F3 ( 243) NtReleaseSemaphore + F 820007B4 8284E06C 0D5 ( 213) NtCreateSemaphore + F 820007B8 8284E05C 084 ( 132) KeQuerySystemTime + F 820007BC 8284E04C 0E8 ( 232) NtQueryInformationFile + F 820007C0 8284E03C 0F7 ( 247) NtSetInformationFile + F 820007C4 8284E02C 0FD ( 253) NtWaitForSingleObjectEx + F 820007C8 8284E01C 0CE ( 206) NtClearEvent + F 820007CC 8284E00C 0F5 ( 245) NtResumeThread + V 820007D0 0AD ( 173) KeTimeStampBundle + F 820007D4 8284DFFC 010 ( 16) ExGetXConfigSetting + V 820007D8 059 ( 89) KeDebugMonitorData + F 820007DC 8284DFEC 097 ( 151) KeSetAffinityThread + F 820007E0 8284DFDC 0FC ( 252) NtSuspendThread + F 820007E4 8284DFCC 081 ( 129) KeQueryBasePriorityThread + V 820007E8 01B ( 27) ExThreadObjectType + F 820007EC 8284DFBC 110 ( 272) ObReferenceObjectByHandle + F 820007F0 8284DFAC 099 ( 153) KeSetBasePriorityThread + F 820007F4 8284DF9C 10B ( 267) ObLookupThreadByThreadId + F 820007F8 8284DF8C 10E ( 270) ObOpenObjectByPointer + F 820007FC 8284DF7C 0DA ( 218) NtDuplicateObject + F 82000800 8284DF6C 101 ( 257) NtYieldExecution + F 82000804 8284DF5C 0F6 ( 246) NtSetEvent + F 82000808 8284DF4C 052 ( 82) KeBugCheck + F 8200080C 8284DF3C 0BC ( 188) MmDeleteKernelStack + F 82000810 8284DF2C 0BB ( 187) MmCreateKernelStack + F 82000814 8284DF1C 0D1 ( 209) NtCreateEvent + F 82000818 8284DF0C 135 ( 309) RtlNtStatusToDosError + F 8200081C 8284DEFC 194 ( 404) XexCheckExecutablePrivilege + F 82000820 8284DEEC 05F ( 95) KeEnterCriticalRegion + F 82000824 8284DEDC 07D ( 125) KeLeaveCriticalRegion + F 82000828 8284DECC 0CC ( 204) NtAllocateVirtualMemory + F 8200082C 8284DEBC 259 ( 601) !! StfsCreateDevice + F 82000830 8284DEAC 103 ( 259) ObCreateSymbolicLink + F 82000834 8284DE9C 25A ( 602) !! StfsControlDevice + F 82000838 8284DE8C 0DB ( 219) NtFlushBuffersFile + F 8200083C 8284DE7C 104 ( 260) ObDeleteSymbolicLink + F 82000840 8284DE6C 105 ( 261) ObDereferenceObject + F 82000844 8284DE5C 0DC ( 220) NtFreeVirtualMemory + F 82000848 8284DE4C 0D2 ( 210) NtCreateFile + F 8200084C 8284DE3C 256 ( 598) XeKeysConsolePrivateKeySign + F 82000850 8284DE2C 0F0 ( 240) NtReadFile + F 82000854 8284DE1C 0FF ( 255) NtWriteFile + F 82000858 8284DE0C 192 ( 402) XeCryptSha + F 8200085C 8284DDFC 257 ( 599) !! XeKeysConsoleSignatureVerification + F 82000860 8284DDEC 015 ( 21) ExRegisterTitleTerminateNotification + F 82000864 8284DDDC 09D ( 157) KeSetEvent + F 82000868 8284DDCC 0B0 ( 176) KeWaitForSingleObject + F 8200086C 8284DDBC 08F ( 143) KeResetEvent + V 82000870 193 ( 403) XexExecutableModuleHandle + F 82000874 8284DDAC 12B ( 299) RtlImageXexHeaderField + F 82000878 8284DD9C 1A5 ( 421) !! __C_specific_handler + F 8200087C 8284DD8C 12C ( 300) RtlInitAnsiString + F 82000880 8284DD7C 0DF ( 223) NtOpenFile + F 82000884 8284DD6C 0CF ( 207) NtClose + F 82000888 8284DD5C 0EF ( 239) NtQueryVolumeInformationFile + F 8200088C 8284DD4C 0C4 ( 196) MmQueryAddressProtect + F 82000890 8284DD3C 0BD ( 189) MmFreePhysicalMemory + F 82000894 8284DD2C 0BA ( 186) MmAllocatePhysicalMemoryEx + F 82000898 8284DD1C 12E ( 302) RtlInitializeCriticalSection + F 8200089C 8284DD0C 130 ( 304) RtlLeaveCriticalSection + F 820008A0 8284DCFC 125 ( 293) RtlEnterCriticalSection + F 820008A4 8284DCEC 12F ( 303) RtlInitializeCriticalSectionAndSpinCount + F 820008A8 8284E11C 00D ( 13) ExCreateThread + F 820008AC 8284E47C 085 ( 133) KeRaiseIrqlToDpcLevel + F 820008B0 8284E48C 0B3 ( 179) KfLowerIrql + F 820008B4 8284E49C 088 ( 136) KeReleaseSemaphore + F 820008B8 8284E4AC 1F8 ( 504) XAudioGetVoiceCategoryVolume + F 820008BC 8284E4BC 1F7 ( 503) XAudioGetVoiceCategoryVolumeChangeMask + F 820008C0 8284E4CC 0AF ( 175) KeWaitForMultipleObjects + F 820008C4 8284E4DC 092 ( 146) KeResumeThread + F 820008C8 8284E4EC 074 ( 116) KeInitializeSemaphore + F 820008CC 8284E4FC 226 ( 550) XMAReleaseContext + F 820008D0 8284E50C 224 ( 548) XMACreateContext + F 820008D4 8284E51C 083 ( 131) KeQueryPerformanceFrequency + F 820008D8 8284E52C 141 ( 321) RtlTryEnterCriticalSection + F 820008DC 8284E53C 0AE ( 174) KeTryToAcquireSpinLockAtRaisedIrql + F 820008E0 8284E54C 1F3 ( 499) XAudioRegisterRenderDriverClient + F 820008E4 8284E55C 1F4 ( 500) XAudioUnregisterRenderDriverClient + F 820008E8 8284E56C 1F5 ( 501) XAudioSubmitRenderDriverFrame + F 820008EC 8284E57C 195 ( 405) XexGetModuleHandle + F 820008F0 8284E58C 147 ( 327) !! RtlUnwind + F 820008F4 8284E59C 152 ( 338) KeTlsAlloc + F 820008F8 8284E5AC 154 ( 340) KeTlsGetValue + F 820008FC 8284E5BC 155 ( 341) KeTlsSetValue + F 82000900 8284E5CC 153 ( 339) KeTlsFree + F 82000904 8284E5DC 119 ( 281) !! RtlCaptureContext + F 82000908 8284E5EC 05D ( 93) KeEnableFpuExceptions + F 8200090C 8284E5FC 0C6 ( 198) MmQueryStatistics + F 82000910 8284E60C 0D7 ( 215) NtCreateTimer + F 82000914 8284E61C 0FA ( 250) NtSetTimerEx + F 82000918 8284E62C 0CD ( 205) NtCancelTimer + F 8200091C 8284E63C 0E7 ( 231) NtQueryFullAttributesFile + F 82000920 8284E64C 127 ( 295) RtlFreeAnsiString + F 82000924 8284E65C 142 ( 322) RtlUnicodeStringToAnsiString + F 82000928 8284E66C 12D ( 301) RtlInitUnicodeString + F 8200092C 8284E67C 133 ( 307) RtlMultiByteToUnicodeN + F 82000930 8284E68C 001 ( 1) DbgBreakPoint + +w> 000000D8 GameDatabase: Title doesn't contain XLAST data! Multiplayer functionality might be limited. +i> 000000D8 Title name: PROJECT SYLPHEED +i> 000000D8 +-------------------- ACHIEVEMENTS -------------------- ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| ID | Title | Description | Type | Gamerscore | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 1 | Space Combat Award | Received after your first space battle in the Glasner Training Area. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 2 | Schlos Base Defense Award | Received for stopping the missile attack on Schlos Base. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 3 | Aegis of the People Medal | Received for escorting all 7 refugee ships to safety. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 4 | TCAF Luna Medal | Received for bravely helping the fleet escape during the invasion of the Matisse System. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 5 | TCAF Mars Medal | Received for bravery beyond the call of duty during the escape from the Matisse System. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 6 | Soldier's Charm Amulet | Given to you by Raymond as a token of his trust. | Event | 50 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 7 | White Griffons Patch | Received by the commander and pilots of the White Griffon Squadron when it is formed. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 8 | TCAF Jupiter Medal | Received for bravery during the enemy's attack on the Alberti System. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 9 | Furious Pursuit Badge | Received for continuing attacks on the enemy and shooting down a large number of ships. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 10 | Solo Aerospace Combat Award | Received for descending into Acheron's atmosphere and engaging in combat alone. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 11 | Operation Nebula Blaze Award | Received for completing the extremely hazardous Operation Nebula Blaze. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 12 | Guilty Roses Patch | Received for repelling the Guilty Roses Squadron. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 13 | Super Battleship Slayer Patch | Received for shooting down the second S battleship. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 14 | TCAF Terra Medal | Received for shielding the fleet and seeing that all ships safely fled the Ingres System. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 15 | Hellfires Patch | Received for repelling the enemy Hellfire Squadron. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 16 | Night Ravens Patch | Received for challenging and eradicating the Night Raven Squadron. | Event | 50 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 17 | Solar System Defense Award | Received for great achievements during the campaign to defend the Solar System. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 18 | Special Operations Medal | Received for heroically destroying the Prometheus Driver. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 19 | 1,000 Units Destroyed Medal | Received for shooting down 1,000 enemy fighters and attackers in combat. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 20 | 10,000 Units Destroyed Medal | Received for shooting down 10,000 enemy fighters and attackers in combat. | Event | 70 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 21 | Ship Hunter Award | Received for shooting down 100 enemy warships in combat. | Event | 50 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 22 | Gigaton Club Patch | Received for shooting down enemy vessels with a total weight of one gigaton. | Event | 70 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 23 | Weapon Lord Patch | Received after you collect all usable equipment for the Delta Saber. | Event | 80 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 24 | TCAF Pilot's Commendation | Commemmorates you as one of the greatest pilots in history. | Event | 100 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +i> 000000D8 +-------------------- PROPERTIES -------------------- ++----------+------------------+-------------+-----------+ +| ID | Name | Matchmaking | Data Size | ++----------+------------------+-------------+-----------+ +| 10000006 | Killed Aircrafts | False | 4 | ++----------+------------------+-------------+-----------+ +| 10000008 | Equipments | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000000A | Clear Time | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000000B | Killed Warships | False | 4 | ++----------+------------------+-------------+-----------+ +| 10008001 | Rank | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000800A | | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000800B | | False | 4 | ++----------+------------------+-------------+-----------+ +| 20000005 | Killed Weight | False | 8 | ++----------+------------------+-------------+-----------+ +| 20000007 | Clear Time | False | 8 | ++----------+------------------+-------------+-----------+ +| 20000009 | Earned Points | False | 8 | ++----------+------------------+-------------+-----------+ +| 40008002 | Gamer Name | False | 2 | ++----------+------------------+-------------+-----------+ +i> 000000D8 +-------------------- CONTEXTS -------------------- ++----------+-------------+-------------+---------------+-----------+ +| ID | Name | Matchmaking | Default Value | Max Value | ++----------+-------------+-------------+---------------+-----------+ +| 00000000 | Game Stage | False | 0 | 28 | ++----------+-------------+-------------+---------------+-----------+ +| 00000001 | Game Status | False | 0 | 9 | ++----------+-------------+-------------+---------------+-----------+ +| 00008001 | | False | 0 | 0 | ++----------+-------------+-------------+---------------+-----------+ +| 0000800A | Game Type | True | 0 | 1 | ++----------+-------------+-------------+---------------+-----------+ +| 0000800B | | True | 0 | 0 | ++----------+-------------+-------------+---------------+-----------+ +i> 000000D8 +-------------------- STATS VIEWS -------------------- ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| ID | View Type | Name | Skilled | Arbitrated | Hidden | Team View | Online Only | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000001 | Leaderboard | Time Attack (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000002 | Leaderboard | Score Attack (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000003 | Leaderboard | Extra 1 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000004 | Leaderboard | Extra 1 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000005 | Leaderboard | Extra 2 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000006 | Leaderboard | Extra 2 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000007 | Leaderboard | Extra 3 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000008 | Leaderboard | Extra 3 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000009 | Leaderboard | Extra 4 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 0000000A | Leaderboard | Extra 4 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 0000000C | Leaderboard | Time Attack (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 0000000D | Leaderboard | Score Attack (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| FFFF0000 | Leaderboard | | True | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +i> 000000D8 +-------------------- PRESENCE MODES -------------------- ++---------------+----------------+------------------+ +| Context Value | Contexts Count | Properties Count | ++---------------+----------------+------------------+ +| 0 | 2 | 0 | ++---------------+----------------+------------------+ +i> 000000D8 XThread01000020 (5) Stack: 70110000-70130000 +i> 000000D8 KernelState: Launching module... +i> 000000D8 XThreadF8000008 (6) Stack: 70150000-701D0000 +K> 01000020 XThread::Execute thid 5 (handle=01000020, 'Kernel Dispatch (01000020)', native=00000194, ) +i> 01000010 Loaded 7 shaders from storage +i> 01000010 Loaded 4 pipeline descriptions, 8 shader translations needed +K> F8000008 XThread::Execute thid 6 (handle=F8000008, 'Main XThread (F8000008)', native=00000198) +i> 01000010 Translated 7 shaders in 3 ms +i> 01000010 Pipeline cache loaded: 4 created, 0 already exist, 4 total stored +i> 01000010 Pipeline creation took 0 milliseconds +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800000C type=1 initial_state=0 lr=824A9F6C +F> F8000008 NullDevice::ResolvePath() +F> F8000008 NullDevice::ResolvePath() +F> F8000008 NullDevice::ResolvePath() +!> F8000008 undefined extern call to 8284E0DC IoDismountVolumeByFileHandle +F> F8000008 NullDevice::ResolvePath() +i> F8000008 Got xam task args: v1 = 02080002, v2 = 00000000 +i> F8000008 XThreadF8000010 (7) Stack: 701F0000-70270000 +K> F8000010 XThread::Execute thid 7 (handle=F8000010, 'XThread01BC (F8000010)', native=000001BC) +F> F8000010 NullDevice::ResolvePath() +w> F8000010 Game is attempting to allocate devkit debug memory (base: 00000000, size: 000FF000). Ignoring debug flag and using normal allocation. +!> F8000010 undefined extern call to 8284DEBC StfsCreateDevice +K> F8000010 AUDIT-HLC KeSetEvent guest_ptr=8287094C lr=824A95D0 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000020 type=1 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000024 (8) Stack: 70290000-702B0000 +K> F8000024 XThread::Execute thid 8 (handle=F8000024, 'XThread01C0 (F8000024)', native=000001C0) +K> F8000024 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000020 alertable=0 lr=824AC578 guest_lr=824AFFC4 +F> F8000008 HostPathDevice::ResolvePath() +i> F8000008 XThreadF800002C (9) Stack: 702D0000-702E0000 +K> F800002C XThread::Execute thid 9 (handle=F800002C, 'XThread01C4 (F800002C)', native=000001C4) +F> F800002C HostPathDevice::ResolvePath() +F> F800002C HostPathDevice::ResolvePath() +F> F8000008 HostPathDevice::ResolvePath(\d4ea4615\e\46ee8ca) +F> F8000008 HostPathDevice::ResolvePath(\d4ea4615\e) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800003C type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000040 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000048 (A) Stack: 70300000-70340000 +K> F8000048 XThread::Execute thid 10 (handle=F8000048, 'XThread01C8 (F8000048)', native=000001C8) +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800003C alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000050 type=0 initial_state=0 lr=824A9F6C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +!> F800002C BaseHeap::Release failed because address is not a region start +!> F800002C PhysicalHeap::Release failed due to parent heap failure +F> F800002C HostPathDevice::ResolvePath() +K> F8000048 AUDIT-HLC NtSetEvent handle=F800004C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800003C result=00000000 lr=824AC578 guest_lr=82452E64 +F> F800002C HostPathDevice::ResolvePath() +!> F800002C BaseHeap::Release failed because address is not a region start +!> F800002C PhysicalHeap::Release failed due to parent heap failure +K> F800002C AUDIT-HLC NtWaitForSingleObjectEx handle=F8000028 alertable=0 lr=824AC578 guest_lr=824AFFC4 +!> F8000008 BaseHeap::Release failed because address is not a region start +!> F8000008 PhysicalHeap::Release failed due to parent heap failure +!> F8000008 BaseHeap::Release failed because address is not a region start +!> F8000008 PhysicalHeap::Release failed due to parent heap failure +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\8\3421153) +F> F8000008 DiscImageDevice::ResolvePath(\dat) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\355f2f8) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000038 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800004C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800004C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000050 type=0 initial_state=0 lr=824A9F6C +i> F8000048 XThreadF8000058 (B) Stack: 70360000-70370000 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F800004C alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 XThread::Execute thid 11 (handle=F8000058, 'XThread01CC (F8000058)', native=000001CC) +K> F8000058 AUDIT-HLC NtSetEvent handle=F800004C lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800004C result=00000000 lr=824AC578 guest_lr=8245148C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F800003C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=82452E64 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000038 type=1 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +i> F8000008 XThreadF800004C (C) Stack: 70390000-703A0000 +K> F800004C XThread::Execute thid 12 (handle=F800004C, 'XThread01D0 (F800004C)', native=000001D0) +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +i> F8000008 Hardware scaler: width ratio 1:1, height ratio 1:1, final aspect ratio 16:9 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +i> 01000010 Selecting rep movs vastcpy. +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000060 type=1 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000064 type=1 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000068 (D) Stack: 703C0000-70440000 +K> F8000068 XThread::Execute thid 13 (handle=F8000068, 'XThread01D4 (F8000068)', native=000001D4) +F> F8000008 HostPathDevice::ResolvePath(\aab216c3\a\2c8c185) +F> F8000008 HostPathDevice::ResolvePath(\aab216c3\a) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000070 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000070 alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000078 alertable=0 lr=824AC578 guest_lr=8245148C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000058 AUDIT-HLC NtSetEvent handle=F8000078 lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000078 result=00000000 lr=824AC578 guest_lr=8245148C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000074 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000070 result=00000000 lr=824AC578 guest_lr=82452E64 +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\73a5c0a) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000070 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000070 alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000078 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 AUDIT-HLC NtSetEvent handle=F8000078 lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000078 result=00000000 lr=824AC578 guest_lr=8245148C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000074 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000070 result=00000000 lr=824AC578 guest_lr=82452E64 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +i> F8000008 XThreadF8000070 (E) Stack: 70460000-704E0000 +i> F8000008 XThreadF8000074 (F) Stack: 70500000-70580000 +K> F8000070 XThread::Execute thid 14 (handle=F8000070, 'XThread01D8 (F8000070)', native=000001D8) +K> F8000074 XThread::Execute thid 15 (handle=F8000074, 'XThread01DC (F8000074)', native=000001DC) +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +i> F8000008 AudioSystem::RegisterClient: driver created for index=0, driver=0x787e2d000040 +i> F8000008 AudioSystem::RegisterClient: client 0 registered successfully +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000088 type=0 initial_state=0 lr=824A9F6C +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\39a9dcc) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000088 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000090 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000088 result=00000000 lr=824AC578 guest_lr=8245FA10 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000088 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +F> F8000008 DiscImageDevice::ResolvePath(\dat) +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000090 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000088 alertable=0 lr=824AC578 guest_lr=82460150 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000088 result=00000000 lr=824AC578 guest_lr=82460150 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000088 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000088 alertable=0 lr=824AC578 guest_lr=82179148 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000090 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000088 result=00000000 lr=824AC578 guest_lr=82179148 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +i> F8000008 XThreadF8000088 (10) Stack: 705A0000-705B0000 +K> F8000088 XThread::Execute thid 16 (handle=F8000088, 'XThread01F0 (F8000088)', native=000001F0) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000094 alertable=0 lr=824AC578 guest_lr=82173BD4 +K> F8000068 AUDIT-HLC NtSetEvent handle=F8000094 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000094 result=00000000 lr=824AC578 guest_lr=82173BD4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000098 (11) Stack: 705D0000-70650000 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000098 alertable=0 lr=824AC578 guest_lr=822F1B50 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000098 XThread::Execute thid 17 (handle=F8000098, 'XThread01F4 (F8000098)', native=000001F4) +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000098 AUDIT-HLC NtCreateEvent handle=F800009C type=1 initial_state=1 lr=824A9F6C +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000A0 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\aab216c3\5\ee70e0a) +F> F8000098 HostPathDevice::ResolvePath(\aab216c3\5) +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A0 alertable=0 lr=824AC578 guest_lr=821CBAE0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000AC alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 AUDIT-HLC NtSetEvent handle=F80000AC lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000AC result=00000000 lr=824AC578 guest_lr=8245148C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000A8 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000A0 result=00000000 lr=824AC578 guest_lr=821CBAE0 +i> F8000098 XThreadF80000A0 (12) Stack: 70670000-70680000 +K> F80000A0 XThread::Execute thid 18 (handle=F80000A0, 'XThread01F8 (F80000A0)', native=000001F8) +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +i> F80000A0 XThreadF80000A8 (13) Stack: 706A0000-706D0000 +i> F80000A0 XThreadF80000AC (14) Stack: 706F0000-70720000 +K> F80000A8 XThread::Execute thid 19 (handle=F80000A8, 'XThread01FC (F80000A8)', native=000001FC) +K> F80000AC XThread::Execute thid 20 (handle=F80000AC, 'XThread0200 (F80000AC)', native=00000200) +K> F80000A8 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A4 alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F80000AC AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A4 alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\c\dba806e) +F> F8000098 HostPathDevice::ResolvePath(\87719002\c) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +F> F8000098 HostPathDevice::ResolvePath(\87719002\c\ec0a96e) +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +F> F8000098 HostPathDevice::ResolvePath(\87719002\c) +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000C8 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\a\60fcb85) +F> F8000098 HostPathDevice::ResolvePath(\87719002\a) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000D4 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\2\85d8849) +F> F8000098 HostPathDevice::ResolvePath(\87719002\2) +F> F80000A0 DiscImageDevice::ResolvePath(\hidden\Resource3D) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000E4 type=1 initial_state=0 lr=824A9F6C +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000E8 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\a\715f485) +F> F8000098 HostPathDevice::ResolvePath(\87719002\a) +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=822DFCC8 +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000F8 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\c\f2a8ccd) +F> F8000098 HostPathDevice::ResolvePath(\87719002\c) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\0\1a2db9c) +F> F8000098 HostPathDevice::ResolvePath(\87719002\0) +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E8 alertable=0 lr=824AC578 guest_lr=821C515C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000B8 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000C4 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D0 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000E0 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000EC lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=822DFCC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=822DFE24 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000F4 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E8 result=00000000 lr=824AC578 guest_lr=821C515C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000100 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000098 result=00000000 lr=824AC578 guest_lr=822F1B50 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F800010C lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000B8 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=822DFE24 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=822DFED0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000098 (15) Stack: 705D0000-705E0000 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000098 XThread::Execute thid 21 (handle=F8000098, 'XThread0204 (F8000098)', native=00000204) +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000094 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=822DFED0 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000094 type=1 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +i> F8000008 XThreadF80000C4 (16) Stack: 70600000-70610000 +K> F80000C4 XThread::Execute thid 22 (handle=F80000C4, 'XThread0208 (F80000C4)', native=00000208) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000CC type=0 initial_state=0 lr=824A9F6C +F> F80000A0 DiscImageDevice::ResolvePath(\hidden\Resource3D) +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000CC alertable=0 lr=824AC578 guest_lr=82172BC8 +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000D8 type=1 initial_state=0 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D8 alertable=0 lr=824AC578 guest_lr=822DFCC8 +K> F80000C4 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000094 alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000CC lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000CC result=00000000 lr=824AC578 guest_lr=82172BC8 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000CC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000DC lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D8 result=00000000 lr=824AC578 guest_lr=822DFCC8 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D8 alertable=0 lr=824AC578 guest_lr=822DFE24 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000CC lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D8 result=00000000 lr=824AC578 guest_lr=822DFE24 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D8 alertable=0 lr=824AC578 guest_lr=822DFED0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E4 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000E4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF80000F0 (17) Stack: 70630000-70640000 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F80000F0 XThread::Execute thid 23 (handle=F80000F0, 'XThread020C (F80000F0)', native=0000020C) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000F4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000100 (18) Stack: 70740000-707C0000 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF800010C (19) Stack: 707E0000-70860000 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000100 XThread::Execute thid 24 (handle=F8000100, 'XThread0210 (F8000100)', native=00000210) +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F800010C XThread::Execute thid 25 (handle=F800010C, 'XThread0214 (F800010C)', native=00000214) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000CC lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D8 result=00000000 lr=824AC578 guest_lr=822DFED0 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +F> F80000A0 DiscImageDevice::ResolvePath(\hidden\Resource3D) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000D0 type=1 initial_state=0 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFCC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFCC8 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFE24 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFE24 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFED0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B0 alertable=0 lr=824AC578 guest_lr=821CC19C +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000B0 lr=824AA304 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFED0 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B0 result=00000000 lr=824AC578 guest_lr=821CC19C +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\f\ca5c62e) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\d\14ba3f8) +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\d) +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B0 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D0 type=0 initial_state=0 lr=824A9F6C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B0 result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\8\14c242d) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\5\6324af0) +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\5) +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B0 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B0 result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\d\70a9531) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\a\c9606f9) +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\a) +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B0 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B0 result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\7\9f2d535) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\4\efaecd1) +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\4) +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B0 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B0 result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\7\0c3bba2) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\4\59fbfe8) +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\4) +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B0 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B0 result=00000000 lr=824AC578 guest_lr=8245FA10 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800009C alertable=0 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800009C result=00000000 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800009C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000BC alertable=0 lr=824AC578 guest_lr=821CC19C +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000BC lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000BC result=00000000 lr=824AC578 guest_lr=821CC19C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800009C alertable=0 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800009C result=00000000 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800009C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF80000CC (1A) Stack: 70880000-70900000 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F80000CC XThread::Execute thid 26 (handle=F80000CC, 'XThread0218 (F80000CC)', native=00000218) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F80000CC AUDIT-HLC NtCreateEvent handle=F80000D8 type=1 initial_state=1 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F80000CC AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +F> F80000CC HostPathDevice::ResolvePath(\aab216c3\5\c10eae6) +F> F80000CC HostPathDevice::ResolvePath(\aab216c3\5) +K> F80000CC AUDIT-HLC NtWaitForSingleObjectEx handle=F80000FC alertable=0 lr=824AC578 guest_lr=821CBAE0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000118 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000118 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000118 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 AUDIT-HLC NtSetEvent handle=F8000118 lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000118 result=00000000 lr=824AC578 guest_lr=8245148C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000114 lr=824AA304 +K> F80000CC AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000FC result=00000000 lr=824AC578 guest_lr=821CBAE0 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000088 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +F> F8000088 DiscImageDevice::ResolvePath(\dat) +K> F8000088 AUDIT-HLC NtSetEvent handle=F8000118 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000110 alertable=0 lr=824AC578 guest_lr=82460150 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000110 result=00000000 lr=824AC578 guest_lr=82460150 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000BC alertable=0 lr=824AC578 guest_lr=82172BC8 +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000BC lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000BC result=00000000 lr=824AC578 guest_lr=82172BC8 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC JitProlog pc=821B55D8 tid=00000006 r3=BCCC52C0 r4=FFFFFFFF r5=00004D2E r6=00000000 r7=64000000 r8=0000003F r9=BC366BA0 r10=00000008 lr=82172D8C +K> F8000008 AUDIT-HLC JitProlog pc=821B55D8 r3+00: 820A3644 00000001 00000000 F80000D8 +K> F8000008 AUDIT-HLC JitProlog pc=821B55D8 r3+10: 0101FFFF 00000000 FFFFFFFF 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821B55D8 r3+20: FFFFFFFF 00000000 00000000 00000002 +K> F8000008 AUDIT-HLC JitProlog pc=821B55D8 r3+30: 820A1870 00000000 BC22CAE0 00000000 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +F> F8000008 DiscImageDevice::ResolvePath(\dat\movie) +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000118 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800011C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000120 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000124 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000128 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800012C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000130 type=0 initial_state=1 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +F> F8000008 DiscImageDevice::ResolvePath(\dat\movie) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000138 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800013C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000140 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000144 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000148 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800014C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000150 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000154 type=0 initial_state=1 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +i> F8000008 XThreadF8000158 (1B) Stack: 70880000-70890000 +i> F8000008 XThreadF800015C (1C) Stack: 708B0000-708C0000 +i> F8000008 XThreadF8000160 (1D) Stack: 708E0000-708F0000 +i> F8000008 XThreadF8000164 (1E) Stack: 70910000-70920000 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25404 lr=82507ABC +K> F800015C XThread::Execute thid 28 (handle=F800015C, 'XThread0220 (F800015C)', native=00000220) +K> F8000158 XThread::Execute thid 27 (handle=F8000158, 'XThread021C (F8000158)', native=0000021C) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000160 XThread::Execute thid 29 (handle=F8000160, 'XThread0224 (F8000160)', native=00000224) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C diff --git a/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.log.sub821B6DF4_zero b/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.log.sub821B6DF4_zero new file mode 100644 index 0000000..366638f --- /dev/null +++ b/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.log.sub821B6DF4_zero @@ -0,0 +1,36427 @@ +i> 000000D4 Build: canary_experimental@99fd19d02 on Jun 5 2026 +i> 000000D4 Storage root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug +i> 000000D4 ----------- CONFIG DUMP ----------- + +[APU] +apu = "any" +apu_max_queued_frames = 8 +enable_xmp = true +ffmpeg_verbose = false +mute = false +use_dedicated_xma_thread = true +xma_decoder = "new" + +[Auditing] +audit_handle_lifecycle = true +audit_jit_prolog_pc = 2182835700 + +[CPU] +break_condition_gpr = -1 +break_condition_op = "eq" +break_condition_truncate = true +break_condition_value = 0 +break_on_debugbreak = true +break_on_instruction = 0 +break_on_start = false +break_on_unimplemented_instructions = true +clock_no_scaling = false +clock_source_raw = false +cpu = "any" +debug_symbol_loader = false +debugprint_trap_log = false +disable_context_promotion = false +disable_instruction_infocache = false +disable_prefetch_and_cachecontrol = true +disassemble_functions = false +dump_translated_hir_functions = false +elide_e0_check = false +emit_inline_mmio_checks = false +emit_mmio_aware_stores_for_recorded_exception_addresses = true +emit_source_annotations = false +enable_early_precompilation = false +full_optimization_even_with_debug = false +ignore_trap_instructions = true +ignore_undefined_externs = true +inline_loadclock = false +inline_mmio_access = true +load_module_map = "" +no_reserved_ops = false +no_round_to_single = false +permit_float_constant_evaluation = false +pvr = 7407360 +record_mmio_access_exceptions = true +store_all_context_values = false +trace_function_coverage = false +trace_function_data = false +trace_function_data_path = "" +trace_function_references = false +trace_functions = false +use_fast_dot_product = false +validate_hir = false +writable_code_segments = false + +[Config] +defaults_date = 2026040912 + +[Content] +license_mask = 0 + +[D3D12] +d3d12_adapter = -1 +d3d12_allow_variable_refresh_rate_and_tearing = true +d3d12_bindless = true +d3d12_break_on_error = false +d3d12_break_on_warning = false +d3d12_debug = false +d3d12_dxbc_disasm = false +d3d12_dxbc_disasm_dxilconv = false +d3d12_pipeline_creation_threads = -1 +d3d12_queue_priority = 1 +d3d12_submit_on_primary_buffer_end = true +d3d12_tessellation_wireframe = false + +[Display] +fullscreen = false +host_present_from_non_ui_thread = true +postprocess_antialiasing = "" +postprocess_dither = true +postprocess_ffx_cas_additional_sharpness = 0 +postprocess_ffx_fsr_max_upsampling_passes = 4 +postprocess_ffx_fsr_sharpness_reduction = 0.20000000298023224 +postprocess_scaling_and_sharpening = "" +present_letterbox = true +present_render_pass_clear = true +present_safe_area_x = 100 +present_safe_area_y = 100 + +[GPU] +anisotropic_override = -1 +async_shader_compilation = true +clear_memory_page_state = false +depth_float24_convert_in_pixel_shader = false +depth_float24_round = false +depth_transfer_not_equal_test = true +disassemble_pm4 = false +draw_resolution_scale_x = 1 +draw_resolution_scale_y = 1 +draw_resolution_scaled_texture_offsets = true +dump_shaders = "" +dxbc_source_map = false +dxbc_switch = true +execute_unclipped_draw_vs_on_cpu = true +execute_unclipped_draw_vs_on_cpu_for_psi_render_backend = true +execute_unclipped_draw_vs_on_cpu_with_scissor = false +force_convert_line_loops_to_strips = false +force_convert_quad_lists_to_triangle_lists = false +force_convert_triangle_fans_to_lists = false +framerate_limit = 0 +gamma_render_target_as_unorm16 = true +gpu = "any" +gpu_3d_to_2d_texture = true +gpu_allow_invalid_fetch_constants = true +gpu_allow_invalid_upload_range = false +half_pixel_offset = true +ignore_32bit_vertex_index_support = false +log_guest_driven_gpu_register_written_values = false +log_ringbuffer_kickoff_initiator_bts = false +mrt_edram_used_range_clamp_to_min = true +native_2x_msaa = true +native_stencil_value_output = true +native_stencil_value_output_d3d12_intel = false +no_discard_stencil_in_transfer_pipelines = false +non_seamless_cube_map = true +occlusion_query = "fast" +occlusion_query_fake_lower_threshold = 80 +occlusion_query_fake_upper_threshold = 100 +occlusion_query_querybatch_range = 0 +occlusion_query_saturation = 1 +primitive_processor_cache_min_indices = 4096 +readback_memexport = false +readback_resolve = "none" +render_target_path_d3d12 = "" +render_target_path_vulkan = "" +resolve_resolution_scale_fill_half_pixel_offset = true +snorm16_render_target_full_range = true +store_shaders = true +target_trace_file = "" +texture_cache_memory_limit_hard = 768 +texture_cache_memory_limit_render_to_texture = 24 +texture_cache_memory_limit_soft = 384 +texture_cache_memory_limit_soft_lifetime = 30 +tiled_shared_memory = true +trace_dump_path = "" +trace_gpu_prefix = "scratch/gpu/" +trace_gpu_stream = false +use_fuzzy_alpha_epsilon = false +vsync = true + +[General] +allow_game_relative_writes = false +allow_plugins = false +apply_patches = true +controller_hotkeys = false +debug = false +disable_doubleclick_fullscreen = false +discord = true +launch_module = "" +notification_sound_path = "" +priority_class = 0 +recent_titles_entry_amount = 10 +time_scalar = 1 + +[HACKS] +ac6_ground_fix = false + +[HID] +guide_button = true +hid = "any" +keyboard_mode = 0 +keyboard_user_index = 0 +left_stick_deadzone_percentage = 0 +right_stick_deadzone_percentage = 0 +vibration = true + +[HID.WinKey] +keybind_a = "0xBA" +keybind_b = "0xDE" +keybind_back = "Z" +keybind_dpad_down = "^S" +keybind_dpad_left = "^A" +keybind_dpad_right = "^D" +keybind_dpad_up = "^W" +keybind_guide = "0x08" +keybind_left_shoulder = "1" +keybind_left_thumb = "F" +keybind_left_thumb_down = "_S" +keybind_left_thumb_left = "_A" +keybind_left_thumb_right = "_D" +keybind_left_thumb_up = "_W" +keybind_left_trigger = "Q I" +keybind_right_shoulder = "3" +keybind_right_thumb = "K" +keybind_right_thumb_down = "0x28" +keybind_right_thumb_left = "0x25" +keybind_right_thumb_right = "0x27" +keybind_right_thumb_up = "0x26" +keybind_right_trigger = "E O" +keybind_start = "X" +keybind_x = "L" +keybind_y = "P" + +[Kernel] +allow_avatar_initialization = false +allow_incompatible_title_update = true +apply_title_update = true +cl = "" +console_type = 0 +default_achievements_backend = "GPD" +ignore_thread_affinities = true +ignore_thread_priorities = false +kernel_build_version = 1888 +kernel_cert_monitor = false +kernel_debug_monitor = false +kernel_display_gamma_power = 2.22222233 +kernel_display_gamma_type = 2 +kernel_pix = false +staging_mode = false + +[Logging] +enable_console = false +flush_log = true +log_file = "" +log_high_frequency_kernel_calls = false +log_level = 2 +log_mask = 0 +log_string_format_kernel_calls = false +log_to_debugprint = false +log_to_stdout = true + +[Memory] +ignore_offset_for_ranged_allocations = false +protect_on_release = false +protect_zero = true +scribble_heap = false +scribble_heap_value = 0 +writable_executable_memory = true + +[Profiles] +logged_profile_slot_0_xuid = "" +logged_profile_slot_1_xuid = "" +logged_profile_slot_2_xuid = "" +logged_profile_slot_3_xuid = "" + +[SDL] +mappings_file = "gamecontrollerdb.txt" + +[Storage] +cache_root = "" +content_root = "" +force_mount_devkit = false +mount_cache = true +mount_memory_unit = false +mount_scratch = false +storage_root = "" + +[UI] +custom_font_path = "" +font_size = 14 +headless = false +imgui_debug = false +profiler_dpi_scaling = false +show_achievement_notification = false +show_profiler = false +storage_selection_dialog = false +window_size_x = 1280 +window_size_y = 720 + +[Video] +avpack = 8 +custom_internal_display_resolution_x = 0 +custom_internal_display_resolution_y = 0 +enable_3d_mode = false +interlaced = false + +[Vulkan] +vulkan_allow_present_mode_fifo_relaxed = true +vulkan_allow_present_mode_immediate = true +vulkan_allow_present_mode_mailbox = true +vulkan_device = -1 +vulkan_log_debug_messages = true +vulkan_pipeline_creation_threads = -1 +vulkan_semaphore_reuse_workaround = false +vulkan_sparse_shared_memory = true +vulkan_validation = false + +[Win32] +win32_high_resolution_timer = true +win32_mmcss = true + +[x64] +align_all_basic_blocks = 0 +delay_via_maybeyield = false +enable_host_guest_stack_synchronization = true +enable_incorrect_roundingmode_behavior = false +enable_rmw_context_merging = false +instrument_call_times = false +max_stackpoints = 65536 +x64_extension_mask = -1 +xop_arithmetic_right_shifts = false +xop_compares = true +xop_left_shifts = false +xop_right_shifts = false +xop_rotates = false +----------- END OF CONFIG DUMP ---- +i> 000000D4 Loaded config: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\xenia-canary.config.toml +i> 000000D4 Content root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\content +i> 000000D4 Host cache root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\cache_host +w> 000000D4 Unable to load Japanese font; JP characters will be boxes +w> 000000D4 Unable to load Japanese font; JP characters will be boxes +i> 00000124 Setup: Initializing Memory... +i> 00000124 Setup: Initializing Exports... +i> 00000124 Setup: Initializing Processor... +i> 00000124 Setup: Initializing Audio... +i> 00000124 Setup: Initializing Graphics... +i> 00000124 Setup: Initializing HID... +i> 00000124 winkey: "0x08" binds key 0x8 to controller input GUIDE. +i> 00000124 winkey: "^A" binds key 0x41 to controller input DPAD_LEFT. +i> 00000124 winkey: "^D" binds key 0x44 to controller input DPAD_RIGHT. +i> 00000124 winkey: "^S" binds key 0x53 to controller input DPAD_DOWN. +i> 00000124 winkey: "^W" binds key 0x57 to controller input DPAD_UP. +i> 00000124 winkey: "_A" binds key 0x41 to controller input LEFT_THUMB_LEFT. +i> 00000124 winkey: "_D" binds key 0x44 to controller input LEFT_THUMB_RIGHT. +i> 00000124 winkey: "_S" binds key 0x53 to controller input LEFT_THUMB_DOWN. +i> 00000124 winkey: "_W" binds key 0x57 to controller input LEFT_THUMB_UP. +i> 00000124 winkey: "F" binds key 0x46 to controller input LEFT_THUMB_PRESSED. +i> 00000124 winkey: "0x26" binds key 0x26 to controller input RIGHT_THUMB_UP. +i> 00000124 winkey: "0x28" binds key 0x28 to controller input RIGHT_THUMB_DOWN. +i> 00000124 winkey: "0x27" binds key 0x27 to controller input RIGHT_THUMB_RIGHT. +i> 00000124 winkey: "0x25" binds key 0x25 to controller input RIGHT_THUMB_LEFT. +i> 00000124 winkey: "K" binds key 0x4B to controller input RIGHT_THUMB_PRESSED. +i> 00000124 winkey: "L" binds key 0x4C to controller input X. +i> 00000124 winkey: "0xDE" binds key 0xDE to controller input B. +i> 00000124 winkey: "0xBA" binds key 0xBA to controller input A. +i> 00000124 winkey: "P" binds key 0x50 to controller input Y. +i> 00000124 winkey: "Q" binds key 0x51 to controller input LEFT_TRIGGER. +i> 00000124 winkey: "I" binds key 0x49 to controller input LEFT_TRIGGER. +i> 00000124 winkey: "E" binds key 0x45 to controller input RIGHT_TRIGGER. +i> 00000124 winkey: "O" binds key 0x4F to controller input RIGHT_TRIGGER. +i> 00000124 winkey: "Z" binds key 0x5A to controller input BACK. +i> 00000124 winkey: "X" binds key 0x58 to controller input START. +i> 00000124 winkey: "1" binds key 0x31 to controller input LEFT_SHOULDER. +i> 00000124 winkey: "3" binds key 0x33 to controller input RIGHT_SHOULDER. +i> 000000D4 SDL Version 2.32.2 initialized. +w> 000000D4 SDL GameControllerDB: file 'gamecontrollerdb.txt' does not exist. +i> 00000124 Setup: Initializing VFS... +i> 00000124 PatchDB: Loaded patches for 0 titles +i> 00000124 Setup: Initializing Kernel... +i> 00000124 ProfileManager: Found 0 Profiles +w> 00000124 BaseHeap::AllocFixed attempting commit on unreserved page +w> 00000124 BaseHeap::AllocFixed attempting commit on unreserved page +i> 00000124 Setup: Starting graphics_system... +i> 00000124 DXGI adapter: NVIDIA GeForce GTX 1070 Ti (vendor 0x1002, device 0x73DF) +i> 00000124 Direct3D 12 device and OS features: +* Max GPU virtual address bits per resource: 40 +* Non-zeroed heap creation: yes +* Pixel-shader-specified stencil reference: no +* Programmable sample positions: tier 0 +* Rasterizer-ordered views: yes +* Resource binding: tier 3 +* Tiled resources: tier 4 +* Unaligned block-compressed textures: yes +i> 00000124 XThread01000010 (1) Stack: 70010000-70030000 +i> 00000124 XThread01000014 (2) Stack: 70050000-70070000 +i> 00000124 Setup: Starting audio_system... +K> 01000010 XThread::Execute thid 1 (handle=01000010, 'GPU Commands (01000010)', native=00000154, ) +K> 01000014 XThread::Execute thid 2 (handle=01000014, 'GPU Frame limiter (01000014)', native=00000158, ) +i> 00000124 XThread01000018 (3) Stack: 70090000-700B0000 +i> 00000124 XThread0100001C (4) Stack: 700D0000-700F0000 +K> 01000018 XThread::Execute thid 3 (handle=01000018, 'XMA Decoder (01000018)', native=00000180, ) +K> 0100001C XThread::Execute thid 4 (handle=0100001C, 'Audio Worker (0100001C)', native=00000184, ) +i> 000000D4 Checking for XISO +F> 000000D4 DiscImageDevice::Initialize +i> 000000D4 Checking for XISO +F> 000000D4 DiscImageDevice::Initialize +F> 000000D4 DiscImageDevice::Initialize +i> 000000D4 Loading module GAME:\default.xex +F> 000000D4 DiscImageDevice::ResolvePath(\default.xex) +i> 000000D4 Module \Device\Cdrom0\default.xex: +Module Hash: CCF935D24A74E002 + Module Flags: 00000001 + XEX_MODULE_TITLE +Security Header: + Image Flags: 00000008 + XEX_IMAGE_XGD2_MEDIA_ONLY + Load Address: 82000000 + Image Size: 00920000 + Export Table: 00000000 +Optional Header Count: 15 + XEX_HEADER_RESOURCE_INFO: + 535107D4 828FB900-8291D8CF, 139215b + XEX_HEADER_FILE_FORMAT_INFO: + Info Size: 36 + Encryption Type: Normal + Compression Type: Normal + Window Size: 32768 + Block Size: 61440 + Block Hash: B3 2B D7 D4 EF 96 9A C5 9F D7 77 C6 8A 99 AA 1C BD 87 1C BE 00 90 2E F1 46 3F A3 D7 00 00 00 10 + XEX_HEADER_ENTRY_POINT: 824AB748 + XEX_HEADER_IMAGE_BASE_ADDRESS: 82000000 + XEX_HEADER_IMPORT_LIBRARIES: + xam.xex - 104 imports + Version: 2.0.4552.0 + Min Version: 2.0.4552.0 + xboxkrnl.exe - 294 imports + Version: 2.0.4552.0 + Min Version: 2.0.4552.0 + XEX_HEADER_CHECKSUM_TIMESTAMP: + Checksum : 00902EF1 + Time Stamp: 463FA3D7 - Tue May 8 00:10:31 2007 + XEX_HEADER_ORIGINAL_PE_NAME: default.pe + XEX_HEADER_STATIC_LIBRARIES: + XAPILIB : 2.0.3215.0 + D3D9 : 2.0.3215.1 + D3DX9 : 2.0.3215.0 + XBOXKRNL : 2.0.3215.0 + XAUD : 2.0.3215.0 + LIBCPMT : 2.0.3215.0 + XMP : 2.0.3215.0 + XMEDIA : 2.0.3215.0 + XONLINE : 2.0.3215.0 + XGRAPHC : 2.0.3215.0 + X3DAUD : 2.0.3215.1 + XACT : 2.0.3215.1 + XEX_HEADER_TLS_INFO: + Slot Count: 64 + Raw Data Address: 00000000 + Data Size: 0 + Raw Data Size: 0 + XEX_HEADER_DEFAULT_STACK_SIZE: 524288 + XEX_HEADER_SYSTEM_FLAGS: 00000400 + XEX_SYSTEM_PAL50_INCOMPATIBLE + XEX_HEADER_EXECUTION_INFO: + Media ID: 2D2E2EEB + Title ID: 535107D4 + Savegame ID: 535107D4 + Disc Number / Total: 1 / 1 + XEX_HEADER_GAME_RATINGS: + ESRB: Teen + PEGI: 12+ + PEGI-FI: 11+ + PEGI - PT: 12+ + BBFC: 12+ + CERO: Unrated + USK: Approved for children aged 12 and above + OFLC - AU: Parental Guidance + OFLC - NZ: Parental Guidance + KMRB: Unrated + Brazil: Unrated + FPB: 13+ + XEX_HEADER_LAN_KEY: E0 3C EA 47 3C AE 06 62 98 8F DB 7F 58 50 12 38 + XEX_HEADER_XBOX360_LOGO: + Section Size: 1736 + Logo Size: 1728 +Sections: + 0 RODATA 1 pages 82000000 - 82010000 (65536 bytes) + 1 RODATA 1 pages 82010000 - 82020000 (65536 bytes) + 2 RODATA 1 pages 82020000 - 82030000 (65536 bytes) + 3 RODATA 1 pages 82030000 - 82040000 (65536 bytes) + 4 RODATA 1 pages 82040000 - 82050000 (65536 bytes) + 5 RODATA 1 pages 82050000 - 82060000 (65536 bytes) + 6 RODATA 1 pages 82060000 - 82070000 (65536 bytes) + 7 RODATA 1 pages 82070000 - 82080000 (65536 bytes) + 8 RODATA 1 pages 82080000 - 82090000 (65536 bytes) + 9 RODATA 1 pages 82090000 - 820A0000 (65536 bytes) + 10 RODATA 1 pages 820A0000 - 820B0000 (65536 bytes) + 11 RODATA 1 pages 820B0000 - 820C0000 (65536 bytes) + 12 RODATA 1 pages 820C0000 - 820D0000 (65536 bytes) + 13 RODATA 1 pages 820D0000 - 820E0000 (65536 bytes) + 14 RODATA 1 pages 820E0000 - 820F0000 (65536 bytes) + 15 RODATA 1 pages 820F0000 - 82100000 (65536 bytes) + 16 RODATA 1 pages 82100000 - 82110000 (65536 bytes) + 17 RODATA 1 pages 82110000 - 82120000 (65536 bytes) + 18 RODATA 1 pages 82120000 - 82130000 (65536 bytes) + 19 RODATA 1 pages 82130000 - 82140000 (65536 bytes) + 20 RODATA 1 pages 82140000 - 82150000 (65536 bytes) + 21 CODE 1 pages 82150000 - 82160000 (65536 bytes) + 22 CODE 1 pages 82160000 - 82170000 (65536 bytes) + 23 CODE 1 pages 82170000 - 82180000 (65536 bytes) + 24 CODE 1 pages 82180000 - 82190000 (65536 bytes) + 25 CODE 1 pages 82190000 - 821A0000 (65536 bytes) + 26 CODE 1 pages 821A0000 - 821B0000 (65536 bytes) + 27 CODE 1 pages 821B0000 - 821C0000 (65536 bytes) + 28 CODE 1 pages 821C0000 - 821D0000 (65536 bytes) + 29 CODE 1 pages 821D0000 - 821E0000 (65536 bytes) + 30 CODE 1 pages 821E0000 - 821F0000 (65536 bytes) + 31 CODE 1 pages 821F0000 - 82200000 (65536 bytes) + 32 CODE 1 pages 82200000 - 82210000 (65536 bytes) + 33 CODE 1 pages 82210000 - 82220000 (65536 bytes) + 34 CODE 1 pages 82220000 - 82230000 (65536 bytes) + 35 CODE 1 pages 82230000 - 82240000 (65536 bytes) + 36 CODE 1 pages 82240000 - 82250000 (65536 bytes) + 37 CODE 1 pages 82250000 - 82260000 (65536 bytes) + 38 CODE 1 pages 82260000 - 82270000 (65536 bytes) + 39 CODE 1 pages 82270000 - 82280000 (65536 bytes) + 40 CODE 1 pages 82280000 - 82290000 (65536 bytes) + 41 CODE 1 pages 82290000 - 822A0000 (65536 bytes) + 42 CODE 1 pages 822A0000 - 822B0000 (65536 bytes) + 43 CODE 1 pages 822B0000 - 822C0000 (65536 bytes) + 44 CODE 1 pages 822C0000 - 822D0000 (65536 bytes) + 45 CODE 1 pages 822D0000 - 822E0000 (65536 bytes) + 46 CODE 1 pages 822E0000 - 822F0000 (65536 bytes) + 47 CODE 1 pages 822F0000 - 82300000 (65536 bytes) + 48 CODE 1 pages 82300000 - 82310000 (65536 bytes) + 49 CODE 1 pages 82310000 - 82320000 (65536 bytes) + 50 CODE 1 pages 82320000 - 82330000 (65536 bytes) + 51 CODE 1 pages 82330000 - 82340000 (65536 bytes) + 52 CODE 1 pages 82340000 - 82350000 (65536 bytes) + 53 CODE 1 pages 82350000 - 82360000 (65536 bytes) + 54 CODE 1 pages 82360000 - 82370000 (65536 bytes) + 55 CODE 1 pages 82370000 - 82380000 (65536 bytes) + 56 CODE 1 pages 82380000 - 82390000 (65536 bytes) + 57 CODE 1 pages 82390000 - 823A0000 (65536 bytes) + 58 CODE 1 pages 823A0000 - 823B0000 (65536 bytes) + 59 CODE 1 pages 823B0000 - 823C0000 (65536 bytes) + 60 CODE 1 pages 823C0000 - 823D0000 (65536 bytes) + 61 CODE 1 pages 823D0000 - 823E0000 (65536 bytes) + 62 CODE 1 pages 823E0000 - 823F0000 (65536 bytes) + 63 CODE 1 pages 823F0000 - 82400000 (65536 bytes) + 64 CODE 1 pages 82400000 - 82410000 (65536 bytes) + 65 CODE 1 pages 82410000 - 82420000 (65536 bytes) + 66 CODE 1 pages 82420000 - 82430000 (65536 bytes) + 67 CODE 1 pages 82430000 - 82440000 (65536 bytes) + 68 CODE 1 pages 82440000 - 82450000 (65536 bytes) + 69 CODE 1 pages 82450000 - 82460000 (65536 bytes) + 70 CODE 1 pages 82460000 - 82470000 (65536 bytes) + 71 CODE 1 pages 82470000 - 82480000 (65536 bytes) + 72 CODE 1 pages 82480000 - 82490000 (65536 bytes) + 73 CODE 1 pages 82490000 - 824A0000 (65536 bytes) + 74 CODE 1 pages 824A0000 - 824B0000 (65536 bytes) + 75 CODE 1 pages 824B0000 - 824C0000 (65536 bytes) + 76 CODE 1 pages 824C0000 - 824D0000 (65536 bytes) + 77 CODE 1 pages 824D0000 - 824E0000 (65536 bytes) + 78 CODE 1 pages 824E0000 - 824F0000 (65536 bytes) + 79 CODE 1 pages 824F0000 - 82500000 (65536 bytes) + 80 CODE 1 pages 82500000 - 82510000 (65536 bytes) + 81 CODE 1 pages 82510000 - 82520000 (65536 bytes) + 82 CODE 1 pages 82520000 - 82530000 (65536 bytes) + 83 CODE 1 pages 82530000 - 82540000 (65536 bytes) + 84 CODE 1 pages 82540000 - 82550000 (65536 bytes) + 85 CODE 1 pages 82550000 - 82560000 (65536 bytes) + 86 CODE 1 pages 82560000 - 82570000 (65536 bytes) + 87 CODE 1 pages 82570000 - 82580000 (65536 bytes) + 88 CODE 1 pages 82580000 - 82590000 (65536 bytes) + 89 CODE 1 pages 82590000 - 825A0000 (65536 bytes) + 90 CODE 1 pages 825A0000 - 825B0000 (65536 bytes) + 91 CODE 1 pages 825B0000 - 825C0000 (65536 bytes) + 92 CODE 1 pages 825C0000 - 825D0000 (65536 bytes) + 93 CODE 1 pages 825D0000 - 825E0000 (65536 bytes) + 94 CODE 1 pages 825E0000 - 825F0000 (65536 bytes) + 95 CODE 1 pages 825F0000 - 82600000 (65536 bytes) + 96 CODE 1 pages 82600000 - 82610000 (65536 bytes) + 97 CODE 1 pages 82610000 - 82620000 (65536 bytes) + 98 CODE 1 pages 82620000 - 82630000 (65536 bytes) + 99 CODE 1 pages 82630000 - 82640000 (65536 bytes) + 100 CODE 1 pages 82640000 - 82650000 (65536 bytes) + 101 CODE 1 pages 82650000 - 82660000 (65536 bytes) + 102 CODE 1 pages 82660000 - 82670000 (65536 bytes) + 103 CODE 1 pages 82670000 - 82680000 (65536 bytes) + 104 CODE 1 pages 82680000 - 82690000 (65536 bytes) + 105 CODE 1 pages 82690000 - 826A0000 (65536 bytes) + 106 CODE 1 pages 826A0000 - 826B0000 (65536 bytes) + 107 CODE 1 pages 826B0000 - 826C0000 (65536 bytes) + 108 CODE 1 pages 826C0000 - 826D0000 (65536 bytes) + 109 CODE 1 pages 826D0000 - 826E0000 (65536 bytes) + 110 CODE 1 pages 826E0000 - 826F0000 (65536 bytes) + 111 CODE 1 pages 826F0000 - 82700000 (65536 bytes) + 112 CODE 1 pages 82700000 - 82710000 (65536 bytes) + 113 CODE 1 pages 82710000 - 82720000 (65536 bytes) + 114 CODE 1 pages 82720000 - 82730000 (65536 bytes) + 115 CODE 1 pages 82730000 - 82740000 (65536 bytes) + 116 CODE 1 pages 82740000 - 82750000 (65536 bytes) + 117 CODE 1 pages 82750000 - 82760000 (65536 bytes) + 118 CODE 1 pages 82760000 - 82770000 (65536 bytes) + 119 CODE 1 pages 82770000 - 82780000 (65536 bytes) + 120 CODE 1 pages 82780000 - 82790000 (65536 bytes) + 121 CODE 1 pages 82790000 - 827A0000 (65536 bytes) + 122 CODE 1 pages 827A0000 - 827B0000 (65536 bytes) + 123 CODE 1 pages 827B0000 - 827C0000 (65536 bytes) + 124 CODE 1 pages 827C0000 - 827D0000 (65536 bytes) + 125 CODE 1 pages 827D0000 - 827E0000 (65536 bytes) + 126 CODE 1 pages 827E0000 - 827F0000 (65536 bytes) + 127 CODE 1 pages 827F0000 - 82800000 (65536 bytes) + 128 CODE 1 pages 82800000 - 82810000 (65536 bytes) + 129 CODE 1 pages 82810000 - 82820000 (65536 bytes) + 130 CODE 1 pages 82820000 - 82830000 (65536 bytes) + 131 CODE 1 pages 82830000 - 82840000 (65536 bytes) + 132 CODE 1 pages 82840000 - 82850000 (65536 bytes) + 133 CODE 1 pages 82850000 - 82860000 (65536 bytes) + 134 CODE 1 pages 82860000 - 82870000 (65536 bytes) + 135 RWDATA 1 pages 82870000 - 82880000 (65536 bytes) + 136 RWDATA 1 pages 82880000 - 82890000 (65536 bytes) + 137 RWDATA 1 pages 82890000 - 828A0000 (65536 bytes) + 138 RWDATA 1 pages 828A0000 - 828B0000 (65536 bytes) + 139 RWDATA 1 pages 828B0000 - 828C0000 (65536 bytes) + 140 RWDATA 1 pages 828C0000 - 828D0000 (65536 bytes) + 141 RWDATA 1 pages 828D0000 - 828E0000 (65536 bytes) + 142 RWDATA 1 pages 828E0000 - 828F0000 (65536 bytes) + 143 RWDATA 1 pages 828F0000 - 82900000 (65536 bytes) + 144 RWDATA 1 pages 82900000 - 82910000 (65536 bytes) + 145 RWDATA 1 pages 82910000 - 82920000 (65536 bytes) +Imports: + xam - 52 imports + Version: 0.0.4552.32 + Min Version: 0.0.4552.32 + + Total: 52 + Known: 100% (52 known, 0 unknown) + Implemented: 98% (51 implemented, 1 unimplemented) + + F 82000600 8284DA7C 28C ( 652) XNotifyPositionUI + F 82000604 8284DA8C 2BC ( 700) XamShowSigninUI + F 82000608 8284DA9C 2C1 ( 705) XamShowKeyboardUI + F 8200060C 8284DAAC 2D5 ( 725) !! XamShowGamerCardUIForXUID + F 82000610 8284DABC 2CB ( 715) XamShowDeviceSelectorUI + F 82000614 8284DACC 2D9 ( 729) XamShowDirtyDiscErrorUI + F 82000618 8284DADC 1B3 ( 435) XamTaskShouldExit + F 8200061C 8284DAEC 1B1 ( 433) XamTaskCloseHandle + F 82000620 8284DAFC 1AF ( 431) XamTaskSchedule + F 82000624 8284DB0C 1A4 ( 420) XamLoaderLaunchTitle + F 82000628 8284DB1C 1F7 ( 503) XMsgStartIORequest + F 8200062C 8284DB2C 20E ( 526) XamUserGetName + F 82000630 8284DB3C 210 ( 528) XamUserGetSigninState + F 82000634 8284DB4C 282 ( 642) XamGetSystemVersion + F 82000638 8284DB5C 2F7 ( 759) XamUserCreateStatsEnumerator + F 8200063C 8284DB6C 2EE ( 750) XamUserCreateAchievementEnumerator + F 82000640 8284DB7C 20A ( 522) XamUserGetXUID + F 82000644 8284DB8C 250 ( 592) XamEnumerate + F 82000648 8284DB9C 3CC ( 972) XGetGameRegion + F 8200064C 8284DBAC 190 ( 400) XamInputGetCapabilities + F 82000650 8284DBBC 191 ( 401) XamInputGetState + F 82000654 8284DBCC 192 ( 402) XamInputSetState + F 82000658 8284DBDC 198 ( 408) XamInputGetKeystrokeEx + F 8200065C 8284DBEC 258 ( 600) XamContentCreate + F 82000660 8284DBFC 25B ( 603) XamContentDelete + F 82000664 8284DC0C 25A ( 602) XamContentClose + F 82000668 8284DC1C 260 ( 608) XamContentSetThumbnail + F 8200066C 8284DC2C 262 ( 610) XamContentGetCreator + F 82000670 8284DC3C 25C ( 604) XamContentCreateEnumerator + F 82000674 8284DC4C 265 ( 613) XamContentGetDeviceState + F 82000678 8284DC5C 25E ( 606) XamContentGetDeviceData + F 8200067C 8284DC6C 25F ( 607) XamContentGetDeviceName + F 82000680 8284DC7C 1A0 ( 416) XamEnableInactivityProcessing + F 82000684 8284DC8C 1A1 ( 417) XamResetInactivity + F 82000688 8284DC9C 2DC ( 732) XamShowMessageBoxUIEx + F 8200068C 8284DCAC 3CD ( 973) XGetLanguage + F 82000690 8284DCBC 3CB ( 971) XGetAVPack + F 82000694 8284DCCC 1A9 ( 425) XamLoaderTerminateTitle + F 82000698 8284DCDC 280 ( 640) XamGetExecutionId + F 8200069C 8284E45C 28B ( 651) XNotifyGetNext + F 820006A0 8284E44C 002 ( 2) NetDll_WSACleanup + F 820006A4 8284E43C 001 ( 1) NetDll_WSAStartup + F 820006A8 8284E46C 28A ( 650) XamNotifyCreateListener + F 820006AC 8284E42C 316 ( 790) XamSessionCreateHandle + F 820006B0 8284E41C 317 ( 791) XamSessionRefObjByHandle + F 820006B4 8284E40C 21A ( 538) XamUserWriteProfileSettings + F 820006B8 8284E3FC 219 ( 537) XamUserReadProfileSettings + F 820006BC 8284E3EC 1EA ( 490) XamAlloc + F 820006C0 8284E3DC 1EC ( 492) XamFree + F 820006C4 8284E3CC 3D1 ( 977) XGetVideoMode + F 820006C8 8284E3BC 1F4 ( 500) XMsgInProcessCall + F 820006CC 8284E3AC 1FC ( 508) XMsgStartIORequestEx + + xboxkrnl - 152 imports + Version: 0.0.4552.32 + Min Version: 0.0.4552.32 + + Total: 152 + Known: 100% (152 known, 0 unknown) + Implemented: 95% (145 implemented, 7 unimplemented) + + F 820006D4 8284E1FC 0B4 ( 180) KfReleaseSpinLock + F 820006D8 8284E20C 0B1 ( 177) KfAcquireSpinLock + F 820006DC 8284E21C 1DF ( 479) KiApcNormalRoutineNop + F 820006E0 8284E22C 1B6 ( 438) VdEnableRingBufferRPtrWriteBack + F 820006E4 8284E23C 1C3 ( 451) VdInitializeRingBuffer + F 820006E8 8284E24C 0BE ( 190) MmGetPhysicalAddress + F 820006EC 8284E25C 1D9 ( 473) VdSetSystemCommandBufferGpuIdentifierAddress + F 820006F0 8284E26C 13B ( 315) sprintf + F 820006F4 8284E27C 1B9 ( 441) VdGetCurrentDisplayGamma + V 820006F8 266 ( 614) KeCertMonitorData + F 820006FC 8284E28C 14D ( 333) _vsnprintf + V 82000700 158 ( 344) XboxKrnlVersion + F 82000704 8284E29C 1DC ( 476) VdShutdownEngines + F 82000708 8284E2AC 1CA ( 458) VdQueryVideoMode + F 8200070C 8284E2BC 1BA ( 442) VdGetCurrentDisplayInformation + F 82000710 8284E2CC 1D3 ( 467) VdSetDisplayMode + F 82000714 8284E2DC 1D5 ( 469) VdSetGraphicsInterruptCallback + F 82000718 8284E2EC 1C2 ( 450) VdInitializeEngines + F 8200071C 8284E2FC 1C6 ( 454) VdIsHSIOTrainingSucceeded + F 82000720 8284E30C 1C9 ( 457) VdQueryVideoFlags + F 82000724 8284E31C 1B1 ( 433) VdCallGraphicsNotificationRoutines + V 82000728 1C0 ( 448) VdGpuClockInMHz + F 8200072C 8284E32C 1C5 ( 453) VdInitializeScalerCommandBuffer + F 82000730 8284E33C 269 ( 617) VdRetrainEDRAM + F 82000734 8284E34C 26A ( 618) VdRetrainEDRAMWorker + V 82000738 1C1 ( 449) VdHSIOCalibrationLock + F 8200073C 8284E35C 06B ( 107) KeLockL2 + F 82000740 8284E36C 06C ( 108) KeUnlockL2 + F 82000744 8284E37C 1C7 ( 455) VdPersistDisplay + F 82000748 8284E38C 25B ( 603) VdSwap + F 8200074C 8284E39C 1BD ( 445) VdGetSystemCommandBuffer + V 82000750 1BE ( 446) VdGlobalDevice + F 82000754 8284E1EC 04D ( 77) KeAcquireSpinLockAtRaisedIrql + F 82000758 8284E1DC 089 ( 137) KeReleaseSpinLockFromRaisedIrql + F 8200075C 8284E1CC 1B4 ( 436) VdEnableDisableClockGating + F 82000760 8284E1BC 13F ( 319) RtlTimeFieldsToTime + F 82000764 8284E1AC 136 ( 310) RtlRaiseException + F 82000768 8284E19C 0EE ( 238) NtQueryVirtualMemory + F 8200076C 8284E18C 11B ( 283) RtlCompareMemoryUlong + F 82000770 8284E17C 066 ( 102) KeGetCurrentProcessType + F 82000774 8284E16C 053 ( 83) KeBugCheckEx + F 82000778 8284E15C 126 ( 294) RtlFillMemoryUlong + V 8200077C 1AE ( 430) ExLoadedCommandLine + F 82000780 8284E14C 05A ( 90) KeDelayExecutionThread + F 82000784 8284E13C 143 ( 323) RtlUnicodeToMultiByteN + F 82000788 8284E12C 0E4 ( 228) NtQueryDirectoryFile + F 8200078C 8284E10C 019 ( 25) ExTerminateThread + F 82000790 8284E0FC 09B ( 155) KeSetCurrentStackPointers + F 82000794 8284E0EC 197 ( 407) XexGetProcedureAddress + F 82000798 8284E0DC 03C ( 60) !! IoDismountVolumeByFileHandle + F 8200079C 8284E0CC 0D9 ( 217) NtDeviceIoControlFile + F 820007A0 8284E0BC 028 ( 40) HalReturnToFirmware + F 820007A4 8284E0AC 003 ( 3) DbgPrint + F 820007A8 8284E09C 140 ( 320) RtlTimeToTimeFields + F 820007AC 8284E08C 0FE ( 254) NtWaitForMultipleObjectsEx + F 820007B0 8284E07C 0F3 ( 243) NtReleaseSemaphore + F 820007B4 8284E06C 0D5 ( 213) NtCreateSemaphore + F 820007B8 8284E05C 084 ( 132) KeQuerySystemTime + F 820007BC 8284E04C 0E8 ( 232) NtQueryInformationFile + F 820007C0 8284E03C 0F7 ( 247) NtSetInformationFile + F 820007C4 8284E02C 0FD ( 253) NtWaitForSingleObjectEx + F 820007C8 8284E01C 0CE ( 206) NtClearEvent + F 820007CC 8284E00C 0F5 ( 245) NtResumeThread + V 820007D0 0AD ( 173) KeTimeStampBundle + F 820007D4 8284DFFC 010 ( 16) ExGetXConfigSetting + V 820007D8 059 ( 89) KeDebugMonitorData + F 820007DC 8284DFEC 097 ( 151) KeSetAffinityThread + F 820007E0 8284DFDC 0FC ( 252) NtSuspendThread + F 820007E4 8284DFCC 081 ( 129) KeQueryBasePriorityThread + V 820007E8 01B ( 27) ExThreadObjectType + F 820007EC 8284DFBC 110 ( 272) ObReferenceObjectByHandle + F 820007F0 8284DFAC 099 ( 153) KeSetBasePriorityThread + F 820007F4 8284DF9C 10B ( 267) ObLookupThreadByThreadId + F 820007F8 8284DF8C 10E ( 270) ObOpenObjectByPointer + F 820007FC 8284DF7C 0DA ( 218) NtDuplicateObject + F 82000800 8284DF6C 101 ( 257) NtYieldExecution + F 82000804 8284DF5C 0F6 ( 246) NtSetEvent + F 82000808 8284DF4C 052 ( 82) KeBugCheck + F 8200080C 8284DF3C 0BC ( 188) MmDeleteKernelStack + F 82000810 8284DF2C 0BB ( 187) MmCreateKernelStack + F 82000814 8284DF1C 0D1 ( 209) NtCreateEvent + F 82000818 8284DF0C 135 ( 309) RtlNtStatusToDosError + F 8200081C 8284DEFC 194 ( 404) XexCheckExecutablePrivilege + F 82000820 8284DEEC 05F ( 95) KeEnterCriticalRegion + F 82000824 8284DEDC 07D ( 125) KeLeaveCriticalRegion + F 82000828 8284DECC 0CC ( 204) NtAllocateVirtualMemory + F 8200082C 8284DEBC 259 ( 601) !! StfsCreateDevice + F 82000830 8284DEAC 103 ( 259) ObCreateSymbolicLink + F 82000834 8284DE9C 25A ( 602) !! StfsControlDevice + F 82000838 8284DE8C 0DB ( 219) NtFlushBuffersFile + F 8200083C 8284DE7C 104 ( 260) ObDeleteSymbolicLink + F 82000840 8284DE6C 105 ( 261) ObDereferenceObject + F 82000844 8284DE5C 0DC ( 220) NtFreeVirtualMemory + F 82000848 8284DE4C 0D2 ( 210) NtCreateFile + F 8200084C 8284DE3C 256 ( 598) XeKeysConsolePrivateKeySign + F 82000850 8284DE2C 0F0 ( 240) NtReadFile + F 82000854 8284DE1C 0FF ( 255) NtWriteFile + F 82000858 8284DE0C 192 ( 402) XeCryptSha + F 8200085C 8284DDFC 257 ( 599) !! XeKeysConsoleSignatureVerification + F 82000860 8284DDEC 015 ( 21) ExRegisterTitleTerminateNotification + F 82000864 8284DDDC 09D ( 157) KeSetEvent + F 82000868 8284DDCC 0B0 ( 176) KeWaitForSingleObject + F 8200086C 8284DDBC 08F ( 143) KeResetEvent + V 82000870 193 ( 403) XexExecutableModuleHandle + F 82000874 8284DDAC 12B ( 299) RtlImageXexHeaderField + F 82000878 8284DD9C 1A5 ( 421) !! __C_specific_handler + F 8200087C 8284DD8C 12C ( 300) RtlInitAnsiString + F 82000880 8284DD7C 0DF ( 223) NtOpenFile + F 82000884 8284DD6C 0CF ( 207) NtClose + F 82000888 8284DD5C 0EF ( 239) NtQueryVolumeInformationFile + F 8200088C 8284DD4C 0C4 ( 196) MmQueryAddressProtect + F 82000890 8284DD3C 0BD ( 189) MmFreePhysicalMemory + F 82000894 8284DD2C 0BA ( 186) MmAllocatePhysicalMemoryEx + F 82000898 8284DD1C 12E ( 302) RtlInitializeCriticalSection + F 8200089C 8284DD0C 130 ( 304) RtlLeaveCriticalSection + F 820008A0 8284DCFC 125 ( 293) RtlEnterCriticalSection + F 820008A4 8284DCEC 12F ( 303) RtlInitializeCriticalSectionAndSpinCount + F 820008A8 8284E11C 00D ( 13) ExCreateThread + F 820008AC 8284E47C 085 ( 133) KeRaiseIrqlToDpcLevel + F 820008B0 8284E48C 0B3 ( 179) KfLowerIrql + F 820008B4 8284E49C 088 ( 136) KeReleaseSemaphore + F 820008B8 8284E4AC 1F8 ( 504) XAudioGetVoiceCategoryVolume + F 820008BC 8284E4BC 1F7 ( 503) XAudioGetVoiceCategoryVolumeChangeMask + F 820008C0 8284E4CC 0AF ( 175) KeWaitForMultipleObjects + F 820008C4 8284E4DC 092 ( 146) KeResumeThread + F 820008C8 8284E4EC 074 ( 116) KeInitializeSemaphore + F 820008CC 8284E4FC 226 ( 550) XMAReleaseContext + F 820008D0 8284E50C 224 ( 548) XMACreateContext + F 820008D4 8284E51C 083 ( 131) KeQueryPerformanceFrequency + F 820008D8 8284E52C 141 ( 321) RtlTryEnterCriticalSection + F 820008DC 8284E53C 0AE ( 174) KeTryToAcquireSpinLockAtRaisedIrql + F 820008E0 8284E54C 1F3 ( 499) XAudioRegisterRenderDriverClient + F 820008E4 8284E55C 1F4 ( 500) XAudioUnregisterRenderDriverClient + F 820008E8 8284E56C 1F5 ( 501) XAudioSubmitRenderDriverFrame + F 820008EC 8284E57C 195 ( 405) XexGetModuleHandle + F 820008F0 8284E58C 147 ( 327) !! RtlUnwind + F 820008F4 8284E59C 152 ( 338) KeTlsAlloc + F 820008F8 8284E5AC 154 ( 340) KeTlsGetValue + F 820008FC 8284E5BC 155 ( 341) KeTlsSetValue + F 82000900 8284E5CC 153 ( 339) KeTlsFree + F 82000904 8284E5DC 119 ( 281) !! RtlCaptureContext + F 82000908 8284E5EC 05D ( 93) KeEnableFpuExceptions + F 8200090C 8284E5FC 0C6 ( 198) MmQueryStatistics + F 82000910 8284E60C 0D7 ( 215) NtCreateTimer + F 82000914 8284E61C 0FA ( 250) NtSetTimerEx + F 82000918 8284E62C 0CD ( 205) NtCancelTimer + F 8200091C 8284E63C 0E7 ( 231) NtQueryFullAttributesFile + F 82000920 8284E64C 127 ( 295) RtlFreeAnsiString + F 82000924 8284E65C 142 ( 322) RtlUnicodeStringToAnsiString + F 82000928 8284E66C 12D ( 301) RtlInitUnicodeString + F 8200092C 8284E67C 133 ( 307) RtlMultiByteToUnicodeN + F 82000930 8284E68C 001 ( 1) DbgBreakPoint + +w> 000000D4 GameDatabase: Title doesn't contain XLAST data! Multiplayer functionality might be limited. +i> 000000D4 Title name: PROJECT SYLPHEED +i> 000000D4 +-------------------- ACHIEVEMENTS -------------------- ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| ID | Title | Description | Type | Gamerscore | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 1 | Space Combat Award | Received after your first space battle in the Glasner Training Area. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 2 | Schlos Base Defense Award | Received for stopping the missile attack on Schlos Base. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 3 | Aegis of the People Medal | Received for escorting all 7 refugee ships to safety. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 4 | TCAF Luna Medal | Received for bravely helping the fleet escape during the invasion of the Matisse System. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 5 | TCAF Mars Medal | Received for bravery beyond the call of duty during the escape from the Matisse System. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 6 | Soldier's Charm Amulet | Given to you by Raymond as a token of his trust. | Event | 50 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 7 | White Griffons Patch | Received by the commander and pilots of the White Griffon Squadron when it is formed. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 8 | TCAF Jupiter Medal | Received for bravery during the enemy's attack on the Alberti System. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 9 | Furious Pursuit Badge | Received for continuing attacks on the enemy and shooting down a large number of ships. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 10 | Solo Aerospace Combat Award | Received for descending into Acheron's atmosphere and engaging in combat alone. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 11 | Operation Nebula Blaze Award | Received for completing the extremely hazardous Operation Nebula Blaze. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 12 | Guilty Roses Patch | Received for repelling the Guilty Roses Squadron. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 13 | Super Battleship Slayer Patch | Received for shooting down the second S battleship. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 14 | TCAF Terra Medal | Received for shielding the fleet and seeing that all ships safely fled the Ingres System. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 15 | Hellfires Patch | Received for repelling the enemy Hellfire Squadron. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 16 | Night Ravens Patch | Received for challenging and eradicating the Night Raven Squadron. | Event | 50 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 17 | Solar System Defense Award | Received for great achievements during the campaign to defend the Solar System. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 18 | Special Operations Medal | Received for heroically destroying the Prometheus Driver. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 19 | 1,000 Units Destroyed Medal | Received for shooting down 1,000 enemy fighters and attackers in combat. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 20 | 10,000 Units Destroyed Medal | Received for shooting down 10,000 enemy fighters and attackers in combat. | Event | 70 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 21 | Ship Hunter Award | Received for shooting down 100 enemy warships in combat. | Event | 50 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 22 | Gigaton Club Patch | Received for shooting down enemy vessels with a total weight of one gigaton. | Event | 70 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 23 | Weapon Lord Patch | Received after you collect all usable equipment for the Delta Saber. | Event | 80 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 24 | TCAF Pilot's Commendation | Commemmorates you as one of the greatest pilots in history. | Event | 100 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +i> 000000D4 +-------------------- PROPERTIES -------------------- ++----------+------------------+-------------+-----------+ +| ID | Name | Matchmaking | Data Size | ++----------+------------------+-------------+-----------+ +| 10000006 | Killed Aircrafts | False | 4 | ++----------+------------------+-------------+-----------+ +| 10000008 | Equipments | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000000A | Clear Time | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000000B | Killed Warships | False | 4 | ++----------+------------------+-------------+-----------+ +| 10008001 | Rank | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000800A | | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000800B | | False | 4 | ++----------+------------------+-------------+-----------+ +| 20000005 | Killed Weight | False | 8 | ++----------+------------------+-------------+-----------+ +| 20000007 | Clear Time | False | 8 | ++----------+------------------+-------------+-----------+ +| 20000009 | Earned Points | False | 8 | ++----------+------------------+-------------+-----------+ +| 40008002 | Gamer Name | False | 2 | ++----------+------------------+-------------+-----------+ +i> 000000D4 +-------------------- CONTEXTS -------------------- ++----------+-------------+-------------+---------------+-----------+ +| ID | Name | Matchmaking | Default Value | Max Value | ++----------+-------------+-------------+---------------+-----------+ +| 00000000 | Game Stage | False | 0 | 28 | ++----------+-------------+-------------+---------------+-----------+ +| 00000001 | Game Status | False | 0 | 9 | ++----------+-------------+-------------+---------------+-----------+ +| 00008001 | | False | 0 | 0 | ++----------+-------------+-------------+---------------+-----------+ +| 0000800A | Game Type | True | 0 | 1 | ++----------+-------------+-------------+---------------+-----------+ +| 0000800B | | True | 0 | 0 | ++----------+-------------+-------------+---------------+-----------+ +i> 000000D4 +-------------------- STATS VIEWS -------------------- ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| ID | View Type | Name | Skilled | Arbitrated | Hidden | Team View | Online Only | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000001 | Leaderboard | Time Attack (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000002 | Leaderboard | Score Attack (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000003 | Leaderboard | Extra 1 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000004 | Leaderboard | Extra 1 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000005 | Leaderboard | Extra 2 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000006 | Leaderboard | Extra 2 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000007 | Leaderboard | Extra 3 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000008 | Leaderboard | Extra 3 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000009 | Leaderboard | Extra 4 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 0000000A | Leaderboard | Extra 4 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 0000000C | Leaderboard | Time Attack (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 0000000D | Leaderboard | Score Attack (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| FFFF0000 | Leaderboard | | True | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +i> 000000D4 +-------------------- PRESENCE MODES -------------------- ++---------------+----------------+------------------+ +| Context Value | Contexts Count | Properties Count | ++---------------+----------------+------------------+ +| 0 | 2 | 0 | ++---------------+----------------+------------------+ +i> 000000D4 XThread01000020 (5) Stack: 70110000-70130000 +i> 000000D4 KernelState: Launching module... +i> 000000D4 XThreadF8000008 (6) Stack: 70150000-701D0000 +K> 01000020 XThread::Execute thid 5 (handle=01000020, 'Kernel Dispatch (01000020)', native=00000190, ) +K> F8000008 XThread::Execute thid 6 (handle=F8000008, 'Main XThread (F8000008)', native=00000194) +i> 01000010 Loaded 7 shaders from storage +i> 01000010 Loaded 4 pipeline descriptions, 8 shader translations needed +i> 01000010 Translated 7 shaders in 3 ms +i> 01000010 Pipeline cache loaded: 4 created, 0 already exist, 4 total stored +i> 01000010 Pipeline creation took 0 milliseconds +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800000C type=1 initial_state=0 lr=824A9F6C +F> F8000008 NullDevice::ResolvePath() +F> F8000008 NullDevice::ResolvePath() +F> F8000008 NullDevice::ResolvePath() +!> F8000008 undefined extern call to 8284E0DC IoDismountVolumeByFileHandle +F> F8000008 NullDevice::ResolvePath() +i> F8000008 Got xam task args: v1 = 02080002, v2 = 00000000 +i> F8000008 XThreadF8000010 (7) Stack: 701F0000-70270000 +K> F8000010 XThread::Execute thid 7 (handle=F8000010, 'XThread01B8 (F8000010)', native=000001B8) +F> F8000010 NullDevice::ResolvePath() +w> F8000010 Game is attempting to allocate devkit debug memory (base: 00000000, size: 000FF000). Ignoring debug flag and using normal allocation. +!> F8000010 undefined extern call to 8284DEBC StfsCreateDevice +K> F8000010 AUDIT-HLC KeSetEvent guest_ptr=8287094C lr=824A95D0 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000020 type=1 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000024 (8) Stack: 70290000-702B0000 +K> F8000024 XThread::Execute thid 8 (handle=F8000024, 'XThread01BC (F8000024)', native=000001BC) +K> F8000024 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000020 alertable=0 lr=824AC578 guest_lr=824AFFC4 +F> F8000008 HostPathDevice::ResolvePath() +i> F8000008 XThreadF800002C (9) Stack: 702D0000-702E0000 +K> F800002C XThread::Execute thid 9 (handle=F800002C, 'XThread01C0 (F800002C)', native=000001C0) +F> F800002C HostPathDevice::ResolvePath() +F> F800002C HostPathDevice::ResolvePath() +F> F8000008 HostPathDevice::ResolvePath(\d4ea4615\e\46ee8ca) +F> F8000008 HostPathDevice::ResolvePath(\d4ea4615\e) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800003C type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000040 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000048 (A) Stack: 70300000-70340000 +K> F8000048 XThread::Execute thid 10 (handle=F8000048, 'XThread01C4 (F8000048)', native=000001C4) +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800003C alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000050 type=0 initial_state=0 lr=824A9F6C +!> F800002C BaseHeap::Release failed because address is not a region start +!> F800002C PhysicalHeap::Release failed due to parent heap failure +F> F800002C HostPathDevice::ResolvePath() +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +F> F800002C HostPathDevice::ResolvePath() +K> F8000048 AUDIT-HLC NtSetEvent handle=F800004C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800003C result=00000000 lr=824AC578 guest_lr=82452E64 +!> F800002C BaseHeap::Release failed because address is not a region start +!> F800002C PhysicalHeap::Release failed due to parent heap failure +K> F800002C AUDIT-HLC NtWaitForSingleObjectEx handle=F8000028 alertable=0 lr=824AC578 guest_lr=824AFFC4 +!> F8000008 BaseHeap::Release failed because address is not a region start +!> F8000008 PhysicalHeap::Release failed due to parent heap failure +!> F8000008 BaseHeap::Release failed because address is not a region start +!> F8000008 PhysicalHeap::Release failed due to parent heap failure +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\8\3421153) +F> F8000008 DiscImageDevice::ResolvePath(\dat) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\355f2f8) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000038 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800004C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800004C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000050 type=0 initial_state=0 lr=824A9F6C +i> F8000048 XThreadF8000058 (B) Stack: 70360000-70370000 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F800004C alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 XThread::Execute thid 11 (handle=F8000058, 'XThread01C8 (F8000058)', native=000001C8) +K> F8000058 AUDIT-HLC NtSetEvent handle=F800004C lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800004C result=00000000 lr=824AC578 guest_lr=8245148C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F800003C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=82452E64 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000038 type=1 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF800004C (C) Stack: 70390000-703A0000 +K> F800004C XThread::Execute thid 12 (handle=F800004C, 'XThread01CC (F800004C)', native=000001CC) +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +i> F8000008 Hardware scaler: width ratio 1:1, height ratio 1:1, final aspect ratio 16:9 +i> 01000010 Selecting rep movs vastcpy. +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000060 type=1 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000064 type=1 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000068 (D) Stack: 703C0000-70440000 +K> F8000068 XThread::Execute thid 13 (handle=F8000068, 'XThread01D0 (F8000068)', native=000001D0) +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +F> F8000008 HostPathDevice::ResolvePath(\aab216c3\a\2c8c185) +F> F8000008 HostPathDevice::ResolvePath(\aab216c3\a) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000070 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000070 alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000078 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 AUDIT-HLC NtSetEvent handle=F8000078 lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000078 result=00000000 lr=824AC578 guest_lr=8245148C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000074 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000070 result=00000000 lr=824AC578 guest_lr=82452E64 +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\73a5c0a) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000070 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000070 alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000078 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 AUDIT-HLC NtSetEvent handle=F8000078 lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000078 result=00000000 lr=824AC578 guest_lr=8245148C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000074 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000070 result=00000000 lr=824AC578 guest_lr=82452E64 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +i> F8000008 XThreadF8000070 (E) Stack: 70460000-704E0000 +i> F8000008 XThreadF8000074 (F) Stack: 70500000-70580000 +K> F8000070 XThread::Execute thid 14 (handle=F8000070, 'XThread01D4 (F8000070)', native=000001D4) +K> F8000074 XThread::Execute thid 15 (handle=F8000074, 'XThread01D8 (F8000074)', native=000001D8) +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +i> F8000008 AudioSystem::RegisterClient: driver created for index=0, driver=0x705e6d000040 +i> F8000008 AudioSystem::RegisterClient: client 0 registered successfully +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000088 type=0 initial_state=0 lr=824A9F6C +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\39a9dcc) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000088 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000090 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000088 result=00000000 lr=824AC578 guest_lr=8245FA10 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000088 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +F> F8000008 DiscImageDevice::ResolvePath(\dat) +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000090 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000088 alertable=0 lr=824AC578 guest_lr=82460150 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000088 result=00000000 lr=824AC578 guest_lr=82460150 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000088 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000088 alertable=0 lr=824AC578 guest_lr=82179148 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000090 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000088 result=00000000 lr=824AC578 guest_lr=82179148 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +i> F8000008 XThreadF8000088 (10) Stack: 705A0000-705B0000 +K> F8000088 XThread::Execute thid 16 (handle=F8000088, 'XThread01EC (F8000088)', native=000001EC) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000094 alertable=0 lr=824AC578 guest_lr=82173BD4 +K> F8000068 AUDIT-HLC NtSetEvent handle=F8000094 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000094 result=00000000 lr=824AC578 guest_lr=82173BD4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000098 (11) Stack: 705D0000-70650000 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000098 alertable=0 lr=824AC578 guest_lr=822F1B50 +K> F8000098 XThread::Execute thid 17 (handle=F8000098, 'XThread01F0 (F8000098)', native=000001F0) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F800009C type=1 initial_state=1 lr=824A9F6C +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000A0 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\aab216c3\5\ee70e0a) +F> F8000098 HostPathDevice::ResolvePath(\aab216c3\5) +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A0 alertable=0 lr=824AC578 guest_lr=821CBAE0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000AC alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 AUDIT-HLC NtSetEvent handle=F80000AC lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000AC result=00000000 lr=824AC578 guest_lr=8245148C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000A8 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000A0 result=00000000 lr=824AC578 guest_lr=821CBAE0 +i> F8000098 XThreadF80000A0 (12) Stack: 70670000-70680000 +K> F80000A0 XThread::Execute thid 18 (handle=F80000A0, 'XThread01F4 (F80000A0)', native=000001F4) +i> F80000A0 XThreadF80000A8 (13) Stack: 706A0000-706D0000 +i> F80000A0 XThreadF80000AC (14) Stack: 706F0000-70720000 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F80000A8 XThread::Execute thid 19 (handle=F80000A8, 'XThread01F8 (F80000A8)', native=000001F8) +K> F80000AC XThread::Execute thid 20 (handle=F80000AC, 'XThread01FC (F80000AC)', native=000001FC) +K> F80000A8 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A4 alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F80000AC AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A4 alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\c\dba806e) +F> F8000098 HostPathDevice::ResolvePath(\87719002\c) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +F> F8000098 HostPathDevice::ResolvePath(\87719002\c\ec0a96e) +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +F> F8000098 HostPathDevice::ResolvePath(\87719002\c) +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000C8 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\a\60fcb85) +F> F8000098 HostPathDevice::ResolvePath(\87719002\a) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000D4 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\2\85d8849) +F> F8000098 HostPathDevice::ResolvePath(\87719002\2) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\a\715f485) +F> F8000098 HostPathDevice::ResolvePath(\87719002\a) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\c\f2a8ccd) +F> F8000098 HostPathDevice::ResolvePath(\87719002\c) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000F8 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\0\1a2db9c) +F> F8000098 HostPathDevice::ResolvePath(\87719002\0) +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C515C +F> F80000A0 DiscImageDevice::ResolvePath(\hidden\Resource3D) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F8000108 type=1 initial_state=0 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000108 alertable=0 lr=824AC578 guest_lr=822DFCC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000B8 lr=824AA304 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000C4 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D0 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000DC lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000E8 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C515C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000F4 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000098 result=00000000 lr=824AC578 guest_lr=822F1B50 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000100 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F800010C lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000108 result=00000000 lr=824AC578 guest_lr=822DFCC8 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000108 alertable=0 lr=824AC578 guest_lr=822DFE24 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000094 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000108 result=00000000 lr=824AC578 guest_lr=822DFE24 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000108 alertable=0 lr=824AC578 guest_lr=822DFED0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF80000C0 (15) Stack: 705D0000-705E0000 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C4 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F80000C0 XThread::Execute thid 21 (handle=F80000C0, 'XThread0200 (F80000C0)', native=00000200) +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C4 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000B4 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000108 result=00000000 lr=824AC578 guest_lr=822DFED0 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000B4 type=1 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +i> F8000008 XThreadF80000B8 (16) Stack: 70600000-70610000 +K> F80000B8 XThread::Execute thid 22 (handle=F80000B8, 'XThread0204 (F80000B8)', native=00000204) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000CC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000CC alertable=0 lr=824AC578 guest_lr=82172BC8 +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000CC lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000CC result=00000000 lr=824AC578 guest_lr=82172BC8 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F80000B8 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B4 alertable=0 lr=824AC578 guest_lr=824AFFC4 +F> F80000A0 DiscImageDevice::ResolvePath(\hidden\Resource3D) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000D0 type=1 initial_state=0 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFCC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFCC8 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFE24 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFE24 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFED0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000E8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F4 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF80000DC (17) Stack: 70630000-70640000 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F4 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F4 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F4 type=0 initial_state=0 lr=824A9F6C +K> F80000DC XThread::Execute thid 23 (handle=F80000DC, 'XThread0208 (F80000DC)', native=00000208) +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F4 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF80000F4 (18) Stack: 70740000-707C0000 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF800010C (19) Stack: 707E0000-70860000 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F80000F4 XThread::Execute thid 24 (handle=F80000F4, 'XThread020C (F80000F4)', native=0000020C) +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F800010C XThread::Execute thid 25 (handle=F800010C, 'XThread0210 (F800010C)', native=00000210) +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFED0 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +F> F80000A0 DiscImageDevice::ResolvePath(\hidden\Resource3D) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000D0 type=1 initial_state=0 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFCC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFCC8 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFE24 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFE24 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFED0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFED0 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\f\ca5c62e) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000CC type=0 initial_state=0 lr=824A9F6C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\d\14ba3f8) +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\d) +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000CC alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000CC result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\8\14c242d) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000CC type=0 initial_state=0 lr=824A9F6C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\5\6324af0) +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\5) +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000CC alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000CC result=00000000 lr=824AC578 guest_lr=8245FA10 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\d\70a9531) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000CC type=0 initial_state=0 lr=824A9F6C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\a\c9606f9) +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\a) +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000CC alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000CC result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\7\9f2d535) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000CC type=0 initial_state=0 lr=824A9F6C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\4\efaecd1) +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\4) +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000CC alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000CC result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\7\0c3bba2) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000CC type=0 initial_state=0 lr=824A9F6C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\4\59fbfe8) +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\4) +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000CC alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000CC result=00000000 lr=824AC578 guest_lr=8245FA10 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B0 alertable=0 lr=824AC578 guest_lr=821CC19C +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000B0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B0 result=00000000 lr=824AC578 guest_lr=821CC19C +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800009C alertable=0 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800009C result=00000000 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800009C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000BC alertable=0 lr=824AC578 guest_lr=821CC19C +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000BC lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000BC result=00000000 lr=824AC578 guest_lr=821CC19C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800009C alertable=0 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800009C result=00000000 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800009C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF80000CC (1A) Stack: 70880000-70900000 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F80000CC XThread::Execute thid 26 (handle=F80000CC, 'XThread0214 (F80000CC)', native=00000214) +K> F80000CC AUDIT-HLC NtCreateEvent handle=F80000D0 type=1 initial_state=1 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F80000CC AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +F> F80000CC HostPathDevice::ResolvePath(\aab216c3\5\c10eae6) +F> F80000CC HostPathDevice::ResolvePath(\aab216c3\5) +K> F80000CC AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D8 alertable=0 lr=824AC578 guest_lr=821CBAE0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000114 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 AUDIT-HLC NtSetEvent handle=F8000114 lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000114 result=00000000 lr=824AC578 guest_lr=8245148C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000110 lr=824AA304 +K> F80000CC AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D8 result=00000000 lr=824AC578 guest_lr=821CBAE0 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000088 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +F> F8000088 DiscImageDevice::ResolvePath(\dat) +K> F8000088 AUDIT-HLC NtSetEvent handle=F8000114 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000104 alertable=0 lr=824AC578 guest_lr=82460150 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000104 result=00000000 lr=824AC578 guest_lr=82460150 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000BC alertable=0 lr=824AC578 guest_lr=82172BC8 +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000BC lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000BC result=00000000 lr=824AC578 guest_lr=82172BC8 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +F> F8000008 DiscImageDevice::ResolvePath(\dat\movie) +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000118 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800011C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000120 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000124 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000128 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800012C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000130 type=0 initial_state=1 lr=824A9F6C +F> F8000008 DiscImageDevice::ResolvePath(\dat\movie) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000138 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800013C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000140 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000144 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000148 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800014C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000150 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000154 type=0 initial_state=1 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +i> F8000008 XThreadF8000158 (1B) Stack: 70880000-70890000 +i> F8000008 XThreadF800015C (1C) Stack: 708B0000-708C0000 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +i> F8000008 XThreadF8000160 (1D) Stack: 708E0000-708F0000 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +i> F8000008 XThreadF8000164 (1E) Stack: 70910000-70920000 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25404 lr=82507ABC +K> F800015C XThread::Execute thid 28 (handle=F800015C, 'XThread021C (F800015C)', native=0000021C) +K> F8000158 XThread::Execute thid 27 (handle=F8000158, 'XThread0218 (F8000158)', native=00000218) +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000160 XThread::Execute thid 29 (handle=F8000160, 'XThread0220 (F8000160)', native=00000220) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 diff --git a/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.stderr.run1 b/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.stderr.run1 new file mode 100644 index 0000000..fd4c8af --- /dev/null +++ b/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.stderr.run1 @@ -0,0 +1,89 @@ +warn: CreateDXGIFactory2: Ignoring flags +info: Game: xenia_canary.exe +info: DXVK: v2.7.1 +info: Build: x86_64 gcc 15.1.0 +info: Vulkan: Found vkGetInstanceProcAddr in winevulkan.dll @ 0x6ffffbd84000 +info: Extension providers: +info: Platform WSI +info: OpenVR +info: OpenVR: could not open registry key, status 2 +info: OpenVR: Failed to locate module +info: OpenXR +info: Enabled instance extensions: +info: VK_EXT_surface_maintenance1 +info: VK_KHR_get_surface_capabilities2 +info: VK_KHR_surface +info: VK_KHR_win32_surface +info: Found device: NVIDIA GeForce GTX 1070 Ti (NVIDIA 580.159.3) +info: Found device: llvmpipe (LLVM 20.1.2, 256 bits) (llvmpipe 25.2.8) +info: Skipping: Software driver +info: DXGI: Hiding actual GPU, reporting: +info: vendor ID: 0x1002 +info: device ID: 0x73df +warn: DxgiAdapter::QueryInterface: Unknown interface query +warn: f0db4c7f-fe5a-42a2-bd62-f2a6cf6fc83e +564.236:00dc:013c:info:vkd3d-proton:vkd3d_instance_apply_application_workarounds: Program name: "xenia_canary.exe" (hash: c099ade372da5277) +564.236:00dc:013c:info:vkd3d-proton:vkd3d_instance_deduce_config_flags_from_environment: shader_cache is used, global_pipeline_cache is enforced. +564.236:00dc:013c:info:vkd3d-proton:vkd3d_config_flags_init_once: VKD3D_CONFIG=''. +564.240:00dc:013c:info:vkd3d-proton:vkd3d_get_vk_version: vkd3d-proton - applicationVersion: 3.0.1. +564.240:00dc:013c:info:vkd3d-proton:vkd3d_instance_init: vkd3d-proton - build: 3b10bd7a7ec6a73. +564.399:00dc:013c:info:vkd3d-proton:vkd3d_init_device_caps: Not all relevant pipeline stages are supported by EXT_dgc. Skipping. +564.825:00dc:013c:info:vkd3d-proton:vkd3d_memory_info_decide_hvv_usage: Topology: Device heaps are split. Assuming small BAR situation. +564.825:00dc:013c:info:vkd3d-proton:vkd3d_memory_info_upload_hvv_memory_properties: Topology: HVV usage is not allowed, using HOST_COHERENT for UPLOAD. +564.827:00dc:013c:info:vkd3d-proton:vkd3d_bindless_state_get_bindless_flags: Device does not support VK_EXT_mutable_descriptor_type (or VALVE). +564.827:00dc:013c:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +564.827:00dc:013c:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +564.827:00dc:013c:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +564.827:00dc:013c:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +564.827:00dc:013c:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +564.827:00dc:013c:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +564.827:00dc:013c:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +564.839:00dc:013c:info:vkd3d-proton:d3d12_device_caps_init_shader_model: Enabling support for SM 6.6. +564.839:00dc:013c:fixme:vkd3d-proton:d3d12_device_caps_init_feature_options1: TotalLaneCount = 2432, may be inaccurate. +564.839:00dc:013c:info:vkd3d-proton:d3d12_device_determine_ray_tracing_tier: DXR support enabled. +564.840:00dc:013c:info:vkd3d-proton:vkd3d_pipeline_library_init_disk_cache: Remapping VKD3D_SHADER_CACHE to: vkd3d-proton.cache. +564.840:00dc:013c:info:vkd3d-proton:vkd3d_pipeline_library_init_disk_cache: Attempting to load disk cache from: vkd3d-proton.cache. +564.843:00dc:0154:info:vkd3d-proton:vkd3d_pipeline_library_disk_thread_main: Performing async setup of stream archive ... +564.844:00dc:0154:info:vkd3d-proton:vkd3d_pipeline_library_disk_cache_merge: Promoting write cache to read cache. No need to merge any disk caches. +564.844:00dc:0154:info:vkd3d-proton:vkd3d_pipeline_library_disk_cache_initial_setup: Merging pipeline libraries took 1.012 ms. +564.845:00dc:0154:info:vkd3d-proton:vkd3d_pipeline_library_disk_cache_initial_setup: Mapping read-only cache took 0.607 ms. +564.845:00dc:0154:info:vkd3d-proton:vkd3d_pipeline_library_disk_cache_initial_setup: Parsing stream archive took 0.370 ms. +564.845:00dc:0154:info:vkd3d-proton:vkd3d_pipeline_library_disk_thread_main: Done performing async setup of stream archive. +564.903:00dc:013c:info:vkd3d-proton:vkd3d_get_vk_version: vkd3d-proton - applicationVersion: 3.0.1. +564.903:00dc:013c:info:vkd3d-proton:vkd3d_instance_init: vkd3d-proton - build: 3b10bd7a7ec6a73. +564.946:00dc:013c:info:vkd3d-proton:vkd3d_init_device_caps: Not all relevant pipeline stages are supported by EXT_dgc. Skipping. +565.065:00dc:013c:info:vkd3d-proton:vkd3d_memory_info_decide_hvv_usage: Topology: Device heaps are split. Assuming small BAR situation. +565.065:00dc:013c:info:vkd3d-proton:vkd3d_memory_info_upload_hvv_memory_properties: Topology: HVV usage is not allowed, using HOST_COHERENT for UPLOAD. +565.066:00dc:013c:info:vkd3d-proton:vkd3d_bindless_state_get_bindless_flags: Device does not support VK_EXT_mutable_descriptor_type (or VALVE). +565.066:00dc:013c:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +565.066:00dc:013c:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +565.066:00dc:013c:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +565.066:00dc:013c:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +565.066:00dc:013c:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +565.066:00dc:013c:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +565.066:00dc:013c:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +565.067:00dc:013c:info:vkd3d-proton:d3d12_device_caps_init_shader_model: Enabling support for SM 6.6. +565.067:00dc:013c:fixme:vkd3d-proton:d3d12_device_caps_init_feature_options1: TotalLaneCount = 2432, may be inaccurate. +565.067:00dc:013c:info:vkd3d-proton:d3d12_device_determine_ray_tracing_tier: DXR support enabled. +565.067:00dc:013c:info:vkd3d-proton:vkd3d_pipeline_library_init_disk_cache: Remapping VKD3D_SHADER_CACHE to: vkd3d-proton.cache. +565.067:00dc:013c:info:vkd3d-proton:vkd3d_pipeline_library_init_disk_cache: Attempting to load disk cache from: vkd3d-proton.cache. +565.068:00dc:015c:info:vkd3d-proton:vkd3d_pipeline_library_disk_thread_main: Performing async setup of stream archive ... +565.068:00dc:015c:info:vkd3d-proton:vkd3d_pipeline_library_disk_cache_merge: No write cache exists. No need to merge any disk caches. +565.068:00dc:015c:info:vkd3d-proton:vkd3d_pipeline_library_disk_cache_initial_setup: Merging pipeline libraries took 0.136 ms. +565.068:00dc:015c:info:vkd3d-proton:vkd3d_pipeline_library_disk_cache_initial_setup: Mapping read-only cache took 0.221 ms. +565.069:00dc:015c:info:vkd3d-proton:vkd3d_pipeline_library_disk_cache_initial_setup: Parsing stream archive took 0.031 ms. +565.069:00dc:015c:info:vkd3d-proton:vkd3d_pipeline_library_disk_thread_main: Done performing async setup of stream archive. +565.075:00dc:013c:fixme:vkd3d-proton:d3d12_command_queue_init: Ignoring priority 0x64. +warn: DXGIGetDebugInterface1: Stub +info: DXGI: Hiding actual GPU, reporting: +info: vendor ID: 0x1002 +info: device ID: 0x73df +565.173:00dc:00e0:info:vkd3d-proton:dxgi_vk_swap_chain_init: Creating swapchain (1280 x 720), BufferCount = 3. +565.194:00dc:00e0:info:vkd3d-proton:dxgi_vk_swap_chain_init_sync_objects: Ensure maximum latency of 3 frames with KHR_present_wait. +565.195:00dc:00e0:info:vkd3d-proton:dxgi_vk_swap_chain_init_sleep_state: Timer interval is 1.0 ms. +warn: DXGI: MakeWindowAssociation: Ignoring flags +warn: DxgiOutput::WaitForVBlank: Inaccurate +info: Setting timer interval to 1000 us +565.773:00dc:0164:info:vkd3d-proton:dxgi_vk_swap_chain_recreate_swapchain_in_present_task: Got 3 swapchain images. +566.349:00dc:016c:fixme:vkd3d-proton:vkd3d_texture_view_desc_fixup: Remapping 2D to 2D_ARRAY. Needs Vulkan spec tightening to match D3D12 properly. +566.387:00dc:0164:info:vkd3d-proton:dxgi_vk_swap_chain_recreate_swapchain_in_present_task: Got 3 swapchain images. diff --git a/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.stderr.run2 b/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.stderr.run2 new file mode 100644 index 0000000..b1ef3c5 --- /dev/null +++ b/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.stderr.run2 @@ -0,0 +1,89 @@ +warn: CreateDXGIFactory2: Ignoring flags +info: Game: xenia_canary.exe +info: DXVK: v2.7.1 +info: Build: x86_64 gcc 15.1.0 +info: Vulkan: Found vkGetInstanceProcAddr in winevulkan.dll @ 0x6ffffbfb4000 +info: Extension providers: +info: Platform WSI +info: OpenVR +info: OpenVR: could not open registry key, status 2 +info: OpenVR: Failed to locate module +info: OpenXR +info: Enabled instance extensions: +info: VK_EXT_surface_maintenance1 +info: VK_KHR_get_surface_capabilities2 +info: VK_KHR_surface +info: VK_KHR_win32_surface +info: Found device: NVIDIA GeForce GTX 1070 Ti (NVIDIA 580.159.3) +info: Found device: llvmpipe (LLVM 20.1.2, 256 bits) (llvmpipe 25.2.8) +info: Skipping: Software driver +info: DXGI: Hiding actual GPU, reporting: +info: vendor ID: 0x1002 +info: device ID: 0x73df +warn: DxgiAdapter::QueryInterface: Unknown interface query +warn: f0db4c7f-fe5a-42a2-bd62-f2a6cf6fc83e +805.907:00d0:0124:info:vkd3d-proton:vkd3d_instance_apply_application_workarounds: Program name: "xenia_canary.exe" (hash: c099ade372da5277) +805.907:00d0:0124:info:vkd3d-proton:vkd3d_instance_deduce_config_flags_from_environment: shader_cache is used, global_pipeline_cache is enforced. +805.907:00d0:0124:info:vkd3d-proton:vkd3d_config_flags_init_once: VKD3D_CONFIG=''. +805.910:00d0:0124:info:vkd3d-proton:vkd3d_get_vk_version: vkd3d-proton - applicationVersion: 3.0.1. +805.910:00d0:0124:info:vkd3d-proton:vkd3d_instance_init: vkd3d-proton - build: 3b10bd7a7ec6a73. +805.955:00d0:0124:info:vkd3d-proton:vkd3d_init_device_caps: Not all relevant pipeline stages are supported by EXT_dgc. Skipping. +806.100:00d0:0124:info:vkd3d-proton:vkd3d_memory_info_decide_hvv_usage: Topology: Device heaps are split. Assuming small BAR situation. +806.100:00d0:0124:info:vkd3d-proton:vkd3d_memory_info_upload_hvv_memory_properties: Topology: HVV usage is not allowed, using HOST_COHERENT for UPLOAD. +806.101:00d0:0124:info:vkd3d-proton:vkd3d_bindless_state_get_bindless_flags: Device does not support VK_EXT_mutable_descriptor_type (or VALVE). +806.101:00d0:0124:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +806.101:00d0:0124:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +806.101:00d0:0124:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +806.101:00d0:0124:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +806.101:00d0:0124:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +806.101:00d0:0124:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +806.101:00d0:0124:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +806.105:00d0:0124:info:vkd3d-proton:d3d12_device_caps_init_shader_model: Enabling support for SM 6.6. +806.105:00d0:0124:fixme:vkd3d-proton:d3d12_device_caps_init_feature_options1: TotalLaneCount = 2432, may be inaccurate. +806.105:00d0:0124:info:vkd3d-proton:d3d12_device_determine_ray_tracing_tier: DXR support enabled. +806.105:00d0:0124:info:vkd3d-proton:vkd3d_pipeline_library_init_disk_cache: Remapping VKD3D_SHADER_CACHE to: vkd3d-proton.cache. +806.105:00d0:0124:info:vkd3d-proton:vkd3d_pipeline_library_init_disk_cache: Attempting to load disk cache from: vkd3d-proton.cache. +806.106:00d0:013c:info:vkd3d-proton:vkd3d_pipeline_library_disk_thread_main: Performing async setup of stream archive ... +806.106:00d0:013c:info:vkd3d-proton:vkd3d_pipeline_library_disk_cache_merge: No write cache exists. No need to merge any disk caches. +806.106:00d0:013c:info:vkd3d-proton:vkd3d_pipeline_library_disk_cache_initial_setup: Merging pipeline libraries took 0.161 ms. +806.107:00d0:013c:info:vkd3d-proton:vkd3d_pipeline_library_disk_cache_initial_setup: Mapping read-only cache took 0.185 ms. +806.107:00d0:013c:info:vkd3d-proton:vkd3d_pipeline_library_disk_cache_initial_setup: Parsing stream archive took 0.028 ms. +806.107:00d0:013c:info:vkd3d-proton:vkd3d_pipeline_library_disk_thread_main: Done performing async setup of stream archive. +806.154:00d0:0124:info:vkd3d-proton:vkd3d_get_vk_version: vkd3d-proton - applicationVersion: 3.0.1. +806.154:00d0:0124:info:vkd3d-proton:vkd3d_instance_init: vkd3d-proton - build: 3b10bd7a7ec6a73. +806.197:00d0:0124:info:vkd3d-proton:vkd3d_init_device_caps: Not all relevant pipeline stages are supported by EXT_dgc. Skipping. +806.310:00d0:0124:info:vkd3d-proton:vkd3d_memory_info_decide_hvv_usage: Topology: Device heaps are split. Assuming small BAR situation. +806.310:00d0:0124:info:vkd3d-proton:vkd3d_memory_info_upload_hvv_memory_properties: Topology: HVV usage is not allowed, using HOST_COHERENT for UPLOAD. +806.310:00d0:0124:info:vkd3d-proton:vkd3d_bindless_state_get_bindless_flags: Device does not support VK_EXT_mutable_descriptor_type (or VALVE). +806.310:00d0:0124:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +806.310:00d0:0124:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +806.310:00d0:0124:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +806.310:00d0:0124:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +806.310:00d0:0124:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +806.310:00d0:0124:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +806.310:00d0:0124:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +806.312:00d0:0124:info:vkd3d-proton:d3d12_device_caps_init_shader_model: Enabling support for SM 6.6. +806.312:00d0:0124:fixme:vkd3d-proton:d3d12_device_caps_init_feature_options1: TotalLaneCount = 2432, may be inaccurate. +806.312:00d0:0124:info:vkd3d-proton:d3d12_device_determine_ray_tracing_tier: DXR support enabled. +806.312:00d0:0124:info:vkd3d-proton:vkd3d_pipeline_library_init_disk_cache: Remapping VKD3D_SHADER_CACHE to: vkd3d-proton.cache. +806.312:00d0:0124:info:vkd3d-proton:vkd3d_pipeline_library_init_disk_cache: Attempting to load disk cache from: vkd3d-proton.cache. +806.313:00d0:0144:info:vkd3d-proton:vkd3d_pipeline_library_disk_thread_main: Performing async setup of stream archive ... +806.313:00d0:0144:info:vkd3d-proton:vkd3d_pipeline_library_disk_cache_merge: No write cache exists. No need to merge any disk caches. +806.313:00d0:0144:info:vkd3d-proton:vkd3d_pipeline_library_disk_cache_initial_setup: Merging pipeline libraries took 0.156 ms. +806.314:00d0:0144:info:vkd3d-proton:vkd3d_pipeline_library_disk_cache_initial_setup: Mapping read-only cache took 0.659 ms. +806.314:00d0:0144:info:vkd3d-proton:vkd3d_pipeline_library_disk_cache_initial_setup: Parsing stream archive took 0.035 ms. +806.314:00d0:0144:info:vkd3d-proton:vkd3d_pipeline_library_disk_thread_main: Done performing async setup of stream archive. +806.319:00d0:0124:fixme:vkd3d-proton:d3d12_command_queue_init: Ignoring priority 0x64. +warn: DXGIGetDebugInterface1: Stub +info: DXGI: Hiding actual GPU, reporting: +info: vendor ID: 0x1002 +info: device ID: 0x73df +806.408:00d0:00d4:info:vkd3d-proton:dxgi_vk_swap_chain_init: Creating swapchain (1280 x 720), BufferCount = 3. +806.422:00d0:00d4:info:vkd3d-proton:dxgi_vk_swap_chain_init_sync_objects: Ensure maximum latency of 3 frames with KHR_present_wait. +806.423:00d0:00d4:info:vkd3d-proton:dxgi_vk_swap_chain_init_sleep_state: Timer interval is 1.0 ms. +warn: DXGI: MakeWindowAssociation: Ignoring flags +warn: DxgiOutput::WaitForVBlank: Inaccurate +info: Setting timer interval to 1000 us +806.948:00d0:014c:info:vkd3d-proton:dxgi_vk_swap_chain_recreate_swapchain_in_present_task: Got 3 swapchain images. +807.499:00d0:0154:fixme:vkd3d-proton:vkd3d_texture_view_desc_fixup: Remapping 2D to 2D_ARRAY. Needs Vulkan spec tightening to match D3D12 properly. +807.521:00d0:014c:info:vkd3d-proton:dxgi_vk_swap_chain_recreate_swapchain_in_present_task: Got 3 swapchain images. diff --git a/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.stderr.run3 b/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.stderr.run3 new file mode 100644 index 0000000..0c80fb5 --- /dev/null +++ b/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.stderr.run3 @@ -0,0 +1,89 @@ +warn: CreateDXGIFactory2: Ignoring flags +info: Game: xenia_canary.exe +info: DXVK: v2.7.1 +info: Build: x86_64 gcc 15.1.0 +info: Vulkan: Found vkGetInstanceProcAddr in winevulkan.dll @ 0x6ffffbfb4000 +info: Extension providers: +info: Platform WSI +info: OpenVR +info: OpenVR: could not open registry key, status 2 +info: OpenVR: Failed to locate module +info: OpenXR +info: Enabled instance extensions: +info: VK_EXT_surface_maintenance1 +info: VK_KHR_get_surface_capabilities2 +info: VK_KHR_surface +info: VK_KHR_win32_surface +info: Found device: NVIDIA GeForce GTX 1070 Ti (NVIDIA 580.159.3) +info: Found device: llvmpipe (LLVM 20.1.2, 256 bits) (llvmpipe 25.2.8) +info: Skipping: Software driver +info: DXGI: Hiding actual GPU, reporting: +info: vendor ID: 0x1002 +info: device ID: 0x73df +warn: DxgiAdapter::QueryInterface: Unknown interface query +warn: f0db4c7f-fe5a-42a2-bd62-f2a6cf6fc83e +893.096:00d4:0128:info:vkd3d-proton:vkd3d_instance_apply_application_workarounds: Program name: "xenia_canary.exe" (hash: c099ade372da5277) +893.096:00d4:0128:info:vkd3d-proton:vkd3d_instance_deduce_config_flags_from_environment: shader_cache is used, global_pipeline_cache is enforced. +893.096:00d4:0128:info:vkd3d-proton:vkd3d_config_flags_init_once: VKD3D_CONFIG=''. +893.099:00d4:0128:info:vkd3d-proton:vkd3d_get_vk_version: vkd3d-proton - applicationVersion: 3.0.1. +893.099:00d4:0128:info:vkd3d-proton:vkd3d_instance_init: vkd3d-proton - build: 3b10bd7a7ec6a73. +893.145:00d4:0128:info:vkd3d-proton:vkd3d_init_device_caps: Not all relevant pipeline stages are supported by EXT_dgc. Skipping. +893.308:00d4:0128:info:vkd3d-proton:vkd3d_memory_info_decide_hvv_usage: Topology: Device heaps are split. Assuming small BAR situation. +893.308:00d4:0128:info:vkd3d-proton:vkd3d_memory_info_upload_hvv_memory_properties: Topology: HVV usage is not allowed, using HOST_COHERENT for UPLOAD. +893.308:00d4:0128:info:vkd3d-proton:vkd3d_bindless_state_get_bindless_flags: Device does not support VK_EXT_mutable_descriptor_type (or VALVE). +893.308:00d4:0128:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +893.308:00d4:0128:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +893.308:00d4:0128:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +893.308:00d4:0128:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +893.308:00d4:0128:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +893.308:00d4:0128:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +893.308:00d4:0128:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +893.310:00d4:0128:info:vkd3d-proton:d3d12_device_caps_init_shader_model: Enabling support for SM 6.6. +893.310:00d4:0128:fixme:vkd3d-proton:d3d12_device_caps_init_feature_options1: TotalLaneCount = 2432, may be inaccurate. +893.310:00d4:0128:info:vkd3d-proton:d3d12_device_determine_ray_tracing_tier: DXR support enabled. +893.310:00d4:0128:info:vkd3d-proton:vkd3d_pipeline_library_init_disk_cache: Remapping VKD3D_SHADER_CACHE to: vkd3d-proton.cache. +893.310:00d4:0128:info:vkd3d-proton:vkd3d_pipeline_library_init_disk_cache: Attempting to load disk cache from: vkd3d-proton.cache. +893.311:00d4:0140:info:vkd3d-proton:vkd3d_pipeline_library_disk_thread_main: Performing async setup of stream archive ... +893.311:00d4:0140:info:vkd3d-proton:vkd3d_pipeline_library_disk_cache_merge: No write cache exists. No need to merge any disk caches. +893.311:00d4:0140:info:vkd3d-proton:vkd3d_pipeline_library_disk_cache_initial_setup: Merging pipeline libraries took 0.187 ms. +893.312:00d4:0140:info:vkd3d-proton:vkd3d_pipeline_library_disk_cache_initial_setup: Mapping read-only cache took 0.161 ms. +893.312:00d4:0140:info:vkd3d-proton:vkd3d_pipeline_library_disk_cache_initial_setup: Parsing stream archive took 0.040 ms. +893.312:00d4:0140:info:vkd3d-proton:vkd3d_pipeline_library_disk_thread_main: Done performing async setup of stream archive. +893.360:00d4:0128:info:vkd3d-proton:vkd3d_get_vk_version: vkd3d-proton - applicationVersion: 3.0.1. +893.360:00d4:0128:info:vkd3d-proton:vkd3d_instance_init: vkd3d-proton - build: 3b10bd7a7ec6a73. +893.405:00d4:0128:info:vkd3d-proton:vkd3d_init_device_caps: Not all relevant pipeline stages are supported by EXT_dgc. Skipping. +893.520:00d4:0128:info:vkd3d-proton:vkd3d_memory_info_decide_hvv_usage: Topology: Device heaps are split. Assuming small BAR situation. +893.520:00d4:0128:info:vkd3d-proton:vkd3d_memory_info_upload_hvv_memory_properties: Topology: HVV usage is not allowed, using HOST_COHERENT for UPLOAD. +893.520:00d4:0128:info:vkd3d-proton:vkd3d_bindless_state_get_bindless_flags: Device does not support VK_EXT_mutable_descriptor_type (or VALVE). +893.520:00d4:0128:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +893.520:00d4:0128:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +893.520:00d4:0128:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +893.520:00d4:0128:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +893.520:00d4:0128:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +893.520:00d4:0128:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +893.520:00d4:0128:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +893.522:00d4:0128:info:vkd3d-proton:d3d12_device_caps_init_shader_model: Enabling support for SM 6.6. +893.522:00d4:0128:fixme:vkd3d-proton:d3d12_device_caps_init_feature_options1: TotalLaneCount = 2432, may be inaccurate. +893.522:00d4:0128:info:vkd3d-proton:d3d12_device_determine_ray_tracing_tier: DXR support enabled. +893.522:00d4:0128:info:vkd3d-proton:vkd3d_pipeline_library_init_disk_cache: Remapping VKD3D_SHADER_CACHE to: vkd3d-proton.cache. +893.522:00d4:0128:info:vkd3d-proton:vkd3d_pipeline_library_init_disk_cache: Attempting to load disk cache from: vkd3d-proton.cache. +893.523:00d4:0148:info:vkd3d-proton:vkd3d_pipeline_library_disk_thread_main: Performing async setup of stream archive ... +893.523:00d4:0148:info:vkd3d-proton:vkd3d_pipeline_library_disk_cache_merge: No write cache exists. No need to merge any disk caches. +893.523:00d4:0148:info:vkd3d-proton:vkd3d_pipeline_library_disk_cache_initial_setup: Merging pipeline libraries took 0.153 ms. +893.523:00d4:0148:info:vkd3d-proton:vkd3d_pipeline_library_disk_cache_initial_setup: Mapping read-only cache took 0.199 ms. +893.523:00d4:0148:info:vkd3d-proton:vkd3d_pipeline_library_disk_cache_initial_setup: Parsing stream archive took 0.034 ms. +893.523:00d4:0148:info:vkd3d-proton:vkd3d_pipeline_library_disk_thread_main: Done performing async setup of stream archive. +893.529:00d4:0128:fixme:vkd3d-proton:d3d12_command_queue_init: Ignoring priority 0x64. +warn: DXGIGetDebugInterface1: Stub +info: DXGI: Hiding actual GPU, reporting: +info: vendor ID: 0x1002 +info: device ID: 0x73df +893.622:00d4:00d8:info:vkd3d-proton:dxgi_vk_swap_chain_init: Creating swapchain (1280 x 720), BufferCount = 3. +893.631:00d4:00d8:info:vkd3d-proton:dxgi_vk_swap_chain_init_sync_objects: Ensure maximum latency of 3 frames with KHR_present_wait. +893.632:00d4:00d8:info:vkd3d-proton:dxgi_vk_swap_chain_init_sleep_state: Timer interval is 1.0 ms. +warn: DXGI: MakeWindowAssociation: Ignoring flags +warn: DxgiOutput::WaitForVBlank: Inaccurate +info: Setting timer interval to 1000 us +894.203:00d4:0150:info:vkd3d-proton:dxgi_vk_swap_chain_recreate_swapchain_in_present_task: Got 3 swapchain images. +894.705:00d4:0158:fixme:vkd3d-proton:vkd3d_texture_view_desc_fixup: Remapping 2D to 2D_ARRAY. Needs Vulkan spec tightening to match D3D12 properly. +894.727:00d4:0150:info:vkd3d-proton:dxgi_vk_swap_chain_recreate_swapchain_in_present_task: Got 3 swapchain images. diff --git a/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.stderr.run4_toml b/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.stderr.run4_toml new file mode 100644 index 0000000..f479ecf --- /dev/null +++ b/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.stderr.run4_toml @@ -0,0 +1,89 @@ +warn: CreateDXGIFactory2: Ignoring flags +info: Game: xenia_canary.exe +info: DXVK: v2.7.1 +info: Build: x86_64 gcc 15.1.0 +info: Vulkan: Found vkGetInstanceProcAddr in winevulkan.dll @ 0x6ffffbfb4000 +info: Extension providers: +info: Platform WSI +info: OpenVR +info: OpenVR: could not open registry key, status 2 +info: OpenVR: Failed to locate module +info: OpenXR +info: Enabled instance extensions: +info: VK_EXT_surface_maintenance1 +info: VK_KHR_get_surface_capabilities2 +info: VK_KHR_surface +info: VK_KHR_win32_surface +info: Found device: NVIDIA GeForce GTX 1070 Ti (NVIDIA 580.159.3) +info: Found device: llvmpipe (LLVM 20.1.2, 256 bits) (llvmpipe 25.2.8) +info: Skipping: Software driver +info: DXGI: Hiding actual GPU, reporting: +info: vendor ID: 0x1002 +info: device ID: 0x73df +warn: DxgiAdapter::QueryInterface: Unknown interface query +warn: f0db4c7f-fe5a-42a2-bd62-f2a6cf6fc83e +956.778:00d0:0124:info:vkd3d-proton:vkd3d_instance_apply_application_workarounds: Program name: "xenia_canary.exe" (hash: c099ade372da5277) +956.778:00d0:0124:info:vkd3d-proton:vkd3d_instance_deduce_config_flags_from_environment: shader_cache is used, global_pipeline_cache is enforced. +956.778:00d0:0124:info:vkd3d-proton:vkd3d_config_flags_init_once: VKD3D_CONFIG=''. +956.781:00d0:0124:info:vkd3d-proton:vkd3d_get_vk_version: vkd3d-proton - applicationVersion: 3.0.1. +956.781:00d0:0124:info:vkd3d-proton:vkd3d_instance_init: vkd3d-proton - build: 3b10bd7a7ec6a73. +956.826:00d0:0124:info:vkd3d-proton:vkd3d_init_device_caps: Not all relevant pipeline stages are supported by EXT_dgc. Skipping. +956.983:00d0:0124:info:vkd3d-proton:vkd3d_memory_info_decide_hvv_usage: Topology: Device heaps are split. Assuming small BAR situation. +956.983:00d0:0124:info:vkd3d-proton:vkd3d_memory_info_upload_hvv_memory_properties: Topology: HVV usage is not allowed, using HOST_COHERENT for UPLOAD. +956.983:00d0:0124:info:vkd3d-proton:vkd3d_bindless_state_get_bindless_flags: Device does not support VK_EXT_mutable_descriptor_type (or VALVE). +956.983:00d0:0124:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +956.983:00d0:0124:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +956.983:00d0:0124:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +956.983:00d0:0124:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +956.983:00d0:0124:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +956.983:00d0:0124:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +956.983:00d0:0124:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +956.985:00d0:0124:info:vkd3d-proton:d3d12_device_caps_init_shader_model: Enabling support for SM 6.6. +956.985:00d0:0124:fixme:vkd3d-proton:d3d12_device_caps_init_feature_options1: TotalLaneCount = 2432, may be inaccurate. +956.985:00d0:0124:info:vkd3d-proton:d3d12_device_determine_ray_tracing_tier: DXR support enabled. +956.985:00d0:0124:info:vkd3d-proton:vkd3d_pipeline_library_init_disk_cache: Remapping VKD3D_SHADER_CACHE to: vkd3d-proton.cache. +956.985:00d0:0124:info:vkd3d-proton:vkd3d_pipeline_library_init_disk_cache: Attempting to load disk cache from: vkd3d-proton.cache. +956.985:00d0:013c:info:vkd3d-proton:vkd3d_pipeline_library_disk_thread_main: Performing async setup of stream archive ... +956.986:00d0:013c:info:vkd3d-proton:vkd3d_pipeline_library_disk_cache_merge: No write cache exists. No need to merge any disk caches. +956.986:00d0:013c:info:vkd3d-proton:vkd3d_pipeline_library_disk_cache_initial_setup: Merging pipeline libraries took 0.171 ms. +956.986:00d0:013c:info:vkd3d-proton:vkd3d_pipeline_library_disk_cache_initial_setup: Mapping read-only cache took 0.269 ms. +956.986:00d0:013c:info:vkd3d-proton:vkd3d_pipeline_library_disk_cache_initial_setup: Parsing stream archive took 0.028 ms. +956.986:00d0:013c:info:vkd3d-proton:vkd3d_pipeline_library_disk_thread_main: Done performing async setup of stream archive. +957.031:00d0:0124:info:vkd3d-proton:vkd3d_get_vk_version: vkd3d-proton - applicationVersion: 3.0.1. +957.031:00d0:0124:info:vkd3d-proton:vkd3d_instance_init: vkd3d-proton - build: 3b10bd7a7ec6a73. +957.075:00d0:0124:info:vkd3d-proton:vkd3d_init_device_caps: Not all relevant pipeline stages are supported by EXT_dgc. Skipping. +957.186:00d0:0124:info:vkd3d-proton:vkd3d_memory_info_decide_hvv_usage: Topology: Device heaps are split. Assuming small BAR situation. +957.186:00d0:0124:info:vkd3d-proton:vkd3d_memory_info_upload_hvv_memory_properties: Topology: HVV usage is not allowed, using HOST_COHERENT for UPLOAD. +957.186:00d0:0124:info:vkd3d-proton:vkd3d_bindless_state_get_bindless_flags: Device does not support VK_EXT_mutable_descriptor_type (or VALVE). +957.186:00d0:0124:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +957.186:00d0:0124:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +957.186:00d0:0124:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +957.186:00d0:0124:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +957.186:00d0:0124:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +957.186:00d0:0124:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +957.186:00d0:0124:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +957.188:00d0:0124:info:vkd3d-proton:d3d12_device_caps_init_shader_model: Enabling support for SM 6.6. +957.188:00d0:0124:fixme:vkd3d-proton:d3d12_device_caps_init_feature_options1: TotalLaneCount = 2432, may be inaccurate. +957.188:00d0:0124:info:vkd3d-proton:d3d12_device_determine_ray_tracing_tier: DXR support enabled. +957.188:00d0:0124:info:vkd3d-proton:vkd3d_pipeline_library_init_disk_cache: Remapping VKD3D_SHADER_CACHE to: vkd3d-proton.cache. +957.188:00d0:0124:info:vkd3d-proton:vkd3d_pipeline_library_init_disk_cache: Attempting to load disk cache from: vkd3d-proton.cache. +957.188:00d0:0144:info:vkd3d-proton:vkd3d_pipeline_library_disk_thread_main: Performing async setup of stream archive ... +957.188:00d0:0144:info:vkd3d-proton:vkd3d_pipeline_library_disk_cache_merge: No write cache exists. No need to merge any disk caches. +957.189:00d0:0144:info:vkd3d-proton:vkd3d_pipeline_library_disk_cache_initial_setup: Merging pipeline libraries took 0.172 ms. +957.189:00d0:0144:info:vkd3d-proton:vkd3d_pipeline_library_disk_cache_initial_setup: Mapping read-only cache took 0.231 ms. +957.189:00d0:0144:info:vkd3d-proton:vkd3d_pipeline_library_disk_cache_initial_setup: Parsing stream archive took 0.029 ms. +957.189:00d0:0144:info:vkd3d-proton:vkd3d_pipeline_library_disk_thread_main: Done performing async setup of stream archive. +957.195:00d0:0124:fixme:vkd3d-proton:d3d12_command_queue_init: Ignoring priority 0x64. +warn: DXGIGetDebugInterface1: Stub +info: DXGI: Hiding actual GPU, reporting: +info: vendor ID: 0x1002 +info: device ID: 0x73df +957.285:00d0:00d4:info:vkd3d-proton:dxgi_vk_swap_chain_init: Creating swapchain (1280 x 720), BufferCount = 3. +957.295:00d0:00d4:info:vkd3d-proton:dxgi_vk_swap_chain_init_sync_objects: Ensure maximum latency of 3 frames with KHR_present_wait. +957.295:00d0:00d4:info:vkd3d-proton:dxgi_vk_swap_chain_init_sleep_state: Timer interval is 1.0 ms. +warn: DXGI: MakeWindowAssociation: Ignoring flags +warn: DxgiOutput::WaitForVBlank: Inaccurate +info: Setting timer interval to 1000 us +957.806:00d0:014c:info:vkd3d-proton:dxgi_vk_swap_chain_recreate_swapchain_in_present_task: Got 3 swapchain images. +958.343:00d0:0154:fixme:vkd3d-proton:vkd3d_texture_view_desc_fixup: Remapping 2D to 2D_ARRAY. Needs Vulkan spec tightening to match D3D12 properly. +958.382:00d0:014c:info:vkd3d-proton:dxgi_vk_swap_chain_recreate_swapchain_in_present_task: Got 3 swapchain images. diff --git a/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.stderr.sub821B55D8 b/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.stderr.sub821B55D8 new file mode 100644 index 0000000..80fd812 --- /dev/null +++ b/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.stderr.sub821B55D8 @@ -0,0 +1,89 @@ +warn: CreateDXGIFactory2: Ignoring flags +info: Game: xenia_canary.exe +info: DXVK: v2.7.1 +info: Build: x86_64 gcc 15.1.0 +info: Vulkan: Found vkGetInstanceProcAddr in winevulkan.dll @ 0x6ffffbfb4000 +info: Extension providers: +info: Platform WSI +info: OpenVR +info: OpenVR: could not open registry key, status 2 +info: OpenVR: Failed to locate module +info: OpenXR +info: Enabled instance extensions: +info: VK_EXT_surface_maintenance1 +info: VK_KHR_get_surface_capabilities2 +info: VK_KHR_surface +info: VK_KHR_win32_surface +info: Found device: NVIDIA GeForce GTX 1070 Ti (NVIDIA 580.159.3) +info: Found device: llvmpipe (LLVM 20.1.2, 256 bits) (llvmpipe 25.2.8) +info: Skipping: Software driver +info: DXGI: Hiding actual GPU, reporting: +info: vendor ID: 0x1002 +info: device ID: 0x73df +warn: DxgiAdapter::QueryInterface: Unknown interface query +warn: f0db4c7f-fe5a-42a2-bd62-f2a6cf6fc83e +1217.108:00d4:0128:info:vkd3d-proton:vkd3d_instance_apply_application_workarounds: Program name: "xenia_canary.exe" (hash: c099ade372da5277) +1217.108:00d4:0128:info:vkd3d-proton:vkd3d_instance_deduce_config_flags_from_environment: shader_cache is used, global_pipeline_cache is enforced. +1217.108:00d4:0128:info:vkd3d-proton:vkd3d_config_flags_init_once: VKD3D_CONFIG=''. +1217.111:00d4:0128:info:vkd3d-proton:vkd3d_get_vk_version: vkd3d-proton - applicationVersion: 3.0.1. +1217.111:00d4:0128:info:vkd3d-proton:vkd3d_instance_init: vkd3d-proton - build: 3b10bd7a7ec6a73. +1217.160:00d4:0128:info:vkd3d-proton:vkd3d_init_device_caps: Not all relevant pipeline stages are supported by EXT_dgc. Skipping. +1217.307:00d4:0128:info:vkd3d-proton:vkd3d_memory_info_decide_hvv_usage: Topology: Device heaps are split. Assuming small BAR situation. +1217.307:00d4:0128:info:vkd3d-proton:vkd3d_memory_info_upload_hvv_memory_properties: Topology: HVV usage is not allowed, using HOST_COHERENT for UPLOAD. +1217.307:00d4:0128:info:vkd3d-proton:vkd3d_bindless_state_get_bindless_flags: Device does not support VK_EXT_mutable_descriptor_type (or VALVE). +1217.307:00d4:0128:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +1217.307:00d4:0128:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +1217.307:00d4:0128:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +1217.307:00d4:0128:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +1217.307:00d4:0128:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +1217.307:00d4:0128:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +1217.307:00d4:0128:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +1217.309:00d4:0128:info:vkd3d-proton:d3d12_device_caps_init_shader_model: Enabling support for SM 6.6. +1217.309:00d4:0128:fixme:vkd3d-proton:d3d12_device_caps_init_feature_options1: TotalLaneCount = 2432, may be inaccurate. +1217.309:00d4:0128:info:vkd3d-proton:d3d12_device_determine_ray_tracing_tier: DXR support enabled. +1217.309:00d4:0128:info:vkd3d-proton:vkd3d_pipeline_library_init_disk_cache: Remapping VKD3D_SHADER_CACHE to: vkd3d-proton.cache. +1217.309:00d4:0128:info:vkd3d-proton:vkd3d_pipeline_library_init_disk_cache: Attempting to load disk cache from: vkd3d-proton.cache. +1217.310:00d4:0140:info:vkd3d-proton:vkd3d_pipeline_library_disk_thread_main: Performing async setup of stream archive ... +1217.310:00d4:0140:info:vkd3d-proton:vkd3d_pipeline_library_disk_cache_merge: No write cache exists. No need to merge any disk caches. +1217.310:00d4:0140:info:vkd3d-proton:vkd3d_pipeline_library_disk_cache_initial_setup: Merging pipeline libraries took 0.166 ms. +1217.310:00d4:0140:info:vkd3d-proton:vkd3d_pipeline_library_disk_cache_initial_setup: Mapping read-only cache took 0.173 ms. +1217.310:00d4:0140:info:vkd3d-proton:vkd3d_pipeline_library_disk_cache_initial_setup: Parsing stream archive took 0.031 ms. +1217.310:00d4:0140:info:vkd3d-proton:vkd3d_pipeline_library_disk_thread_main: Done performing async setup of stream archive. +1217.360:00d4:0128:info:vkd3d-proton:vkd3d_get_vk_version: vkd3d-proton - applicationVersion: 3.0.1. +1217.360:00d4:0128:info:vkd3d-proton:vkd3d_instance_init: vkd3d-proton - build: 3b10bd7a7ec6a73. +1217.403:00d4:0128:info:vkd3d-proton:vkd3d_init_device_caps: Not all relevant pipeline stages are supported by EXT_dgc. Skipping. +1217.515:00d4:0128:info:vkd3d-proton:vkd3d_memory_info_decide_hvv_usage: Topology: Device heaps are split. Assuming small BAR situation. +1217.515:00d4:0128:info:vkd3d-proton:vkd3d_memory_info_upload_hvv_memory_properties: Topology: HVV usage is not allowed, using HOST_COHERENT for UPLOAD. +1217.515:00d4:0128:info:vkd3d-proton:vkd3d_bindless_state_get_bindless_flags: Device does not support VK_EXT_mutable_descriptor_type (or VALVE). +1217.515:00d4:0128:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +1217.515:00d4:0128:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +1217.515:00d4:0128:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +1217.515:00d4:0128:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +1217.515:00d4:0128:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +1217.515:00d4:0128:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +1217.515:00d4:0128:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +1217.516:00d4:0128:info:vkd3d-proton:d3d12_device_caps_init_shader_model: Enabling support for SM 6.6. +1217.516:00d4:0128:fixme:vkd3d-proton:d3d12_device_caps_init_feature_options1: TotalLaneCount = 2432, may be inaccurate. +1217.516:00d4:0128:info:vkd3d-proton:d3d12_device_determine_ray_tracing_tier: DXR support enabled. +1217.516:00d4:0128:info:vkd3d-proton:vkd3d_pipeline_library_init_disk_cache: Remapping VKD3D_SHADER_CACHE to: vkd3d-proton.cache. +1217.516:00d4:0128:info:vkd3d-proton:vkd3d_pipeline_library_init_disk_cache: Attempting to load disk cache from: vkd3d-proton.cache. +1217.517:00d4:0148:info:vkd3d-proton:vkd3d_pipeline_library_disk_thread_main: Performing async setup of stream archive ... +1217.517:00d4:0148:info:vkd3d-proton:vkd3d_pipeline_library_disk_cache_merge: No write cache exists. No need to merge any disk caches. +1217.517:00d4:0148:info:vkd3d-proton:vkd3d_pipeline_library_disk_cache_initial_setup: Merging pipeline libraries took 0.157 ms. +1217.517:00d4:0148:info:vkd3d-proton:vkd3d_pipeline_library_disk_cache_initial_setup: Mapping read-only cache took 0.208 ms. +1217.518:00d4:0148:info:vkd3d-proton:vkd3d_pipeline_library_disk_cache_initial_setup: Parsing stream archive took 0.032 ms. +1217.518:00d4:0148:info:vkd3d-proton:vkd3d_pipeline_library_disk_thread_main: Done performing async setup of stream archive. +1217.524:00d4:0128:fixme:vkd3d-proton:d3d12_command_queue_init: Ignoring priority 0x64. +warn: DXGIGetDebugInterface1: Stub +info: DXGI: Hiding actual GPU, reporting: +info: vendor ID: 0x1002 +info: device ID: 0x73df +1217.612:00d4:00d8:info:vkd3d-proton:dxgi_vk_swap_chain_init: Creating swapchain (1280 x 720), BufferCount = 3. +1217.622:00d4:00d8:info:vkd3d-proton:dxgi_vk_swap_chain_init_sync_objects: Ensure maximum latency of 3 frames with KHR_present_wait. +1217.622:00d4:00d8:info:vkd3d-proton:dxgi_vk_swap_chain_init_sleep_state: Timer interval is 1.0 ms. +warn: DXGI: MakeWindowAssociation: Ignoring flags +warn: DxgiOutput::WaitForVBlank: Inaccurate +info: Setting timer interval to 1000 us +1218.136:00d4:0150:info:vkd3d-proton:dxgi_vk_swap_chain_recreate_swapchain_in_present_task: Got 3 swapchain images. +1218.678:00d4:0158:fixme:vkd3d-proton:vkd3d_texture_view_desc_fixup: Remapping 2D to 2D_ARRAY. Needs Vulkan spec tightening to match D3D12 properly. +1218.699:00d4:0150:info:vkd3d-proton:dxgi_vk_swap_chain_recreate_swapchain_in_present_task: Got 3 swapchain images. diff --git a/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.stderr.sub821B6DF4_zero b/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.stderr.sub821B6DF4_zero new file mode 100644 index 0000000..e7ac866 --- /dev/null +++ b/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.stderr.sub821B6DF4_zero @@ -0,0 +1,89 @@ +warn: CreateDXGIFactory2: Ignoring flags +info: Game: xenia_canary.exe +info: DXVK: v2.7.1 +info: Build: x86_64 gcc 15.1.0 +info: Vulkan: Found vkGetInstanceProcAddr in winevulkan.dll @ 0x6ffffbfb4000 +info: Extension providers: +info: Platform WSI +info: OpenVR +info: OpenVR: could not open registry key, status 2 +info: OpenVR: Failed to locate module +info: OpenXR +info: Enabled instance extensions: +info: VK_EXT_surface_maintenance1 +info: VK_KHR_get_surface_capabilities2 +info: VK_KHR_surface +info: VK_KHR_win32_surface +info: Found device: NVIDIA GeForce GTX 1070 Ti (NVIDIA 580.159.3) +info: Found device: llvmpipe (LLVM 20.1.2, 256 bits) (llvmpipe 25.2.8) +info: Skipping: Software driver +info: DXGI: Hiding actual GPU, reporting: +info: vendor ID: 0x1002 +info: device ID: 0x73df +warn: DxgiAdapter::QueryInterface: Unknown interface query +warn: f0db4c7f-fe5a-42a2-bd62-f2a6cf6fc83e +1413.916:00d0:0124:info:vkd3d-proton:vkd3d_instance_apply_application_workarounds: Program name: "xenia_canary.exe" (hash: c099ade372da5277) +1413.916:00d0:0124:info:vkd3d-proton:vkd3d_instance_deduce_config_flags_from_environment: shader_cache is used, global_pipeline_cache is enforced. +1413.916:00d0:0124:info:vkd3d-proton:vkd3d_config_flags_init_once: VKD3D_CONFIG=''. +1413.919:00d0:0124:info:vkd3d-proton:vkd3d_get_vk_version: vkd3d-proton - applicationVersion: 3.0.1. +1413.919:00d0:0124:info:vkd3d-proton:vkd3d_instance_init: vkd3d-proton - build: 3b10bd7a7ec6a73. +1413.963:00d0:0124:info:vkd3d-proton:vkd3d_init_device_caps: Not all relevant pipeline stages are supported by EXT_dgc. Skipping. +1414.109:00d0:0124:info:vkd3d-proton:vkd3d_memory_info_decide_hvv_usage: Topology: Device heaps are split. Assuming small BAR situation. +1414.109:00d0:0124:info:vkd3d-proton:vkd3d_memory_info_upload_hvv_memory_properties: Topology: HVV usage is not allowed, using HOST_COHERENT for UPLOAD. +1414.109:00d0:0124:info:vkd3d-proton:vkd3d_bindless_state_get_bindless_flags: Device does not support VK_EXT_mutable_descriptor_type (or VALVE). +1414.109:00d0:0124:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +1414.109:00d0:0124:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +1414.109:00d0:0124:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +1414.109:00d0:0124:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +1414.109:00d0:0124:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +1414.109:00d0:0124:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +1414.109:00d0:0124:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +1414.111:00d0:0124:info:vkd3d-proton:d3d12_device_caps_init_shader_model: Enabling support for SM 6.6. +1414.111:00d0:0124:fixme:vkd3d-proton:d3d12_device_caps_init_feature_options1: TotalLaneCount = 2432, may be inaccurate. +1414.111:00d0:0124:info:vkd3d-proton:d3d12_device_determine_ray_tracing_tier: DXR support enabled. +1414.111:00d0:0124:info:vkd3d-proton:vkd3d_pipeline_library_init_disk_cache: Remapping VKD3D_SHADER_CACHE to: vkd3d-proton.cache. +1414.111:00d0:0124:info:vkd3d-proton:vkd3d_pipeline_library_init_disk_cache: Attempting to load disk cache from: vkd3d-proton.cache. +1414.112:00d0:013c:info:vkd3d-proton:vkd3d_pipeline_library_disk_thread_main: Performing async setup of stream archive ... +1414.112:00d0:013c:info:vkd3d-proton:vkd3d_pipeline_library_disk_cache_merge: No write cache exists. No need to merge any disk caches. +1414.112:00d0:013c:info:vkd3d-proton:vkd3d_pipeline_library_disk_cache_initial_setup: Merging pipeline libraries took 0.173 ms. +1414.113:00d0:013c:info:vkd3d-proton:vkd3d_pipeline_library_disk_cache_initial_setup: Mapping read-only cache took 0.276 ms. +1414.113:00d0:013c:info:vkd3d-proton:vkd3d_pipeline_library_disk_cache_initial_setup: Parsing stream archive took 0.029 ms. +1414.113:00d0:013c:info:vkd3d-proton:vkd3d_pipeline_library_disk_thread_main: Done performing async setup of stream archive. +1414.157:00d0:0124:info:vkd3d-proton:vkd3d_get_vk_version: vkd3d-proton - applicationVersion: 3.0.1. +1414.157:00d0:0124:info:vkd3d-proton:vkd3d_instance_init: vkd3d-proton - build: 3b10bd7a7ec6a73. +1414.199:00d0:0124:info:vkd3d-proton:vkd3d_init_device_caps: Not all relevant pipeline stages are supported by EXT_dgc. Skipping. +1414.310:00d0:0124:info:vkd3d-proton:vkd3d_memory_info_decide_hvv_usage: Topology: Device heaps are split. Assuming small BAR situation. +1414.310:00d0:0124:info:vkd3d-proton:vkd3d_memory_info_upload_hvv_memory_properties: Topology: HVV usage is not allowed, using HOST_COHERENT for UPLOAD. +1414.311:00d0:0124:info:vkd3d-proton:vkd3d_bindless_state_get_bindless_flags: Device does not support VK_EXT_mutable_descriptor_type (or VALVE). +1414.311:00d0:0124:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +1414.311:00d0:0124:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +1414.311:00d0:0124:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +1414.311:00d0:0124:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +1414.311:00d0:0124:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +1414.311:00d0:0124:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +1414.311:00d0:0124:info:vkd3d-proton:vkd3d_bindless_state_add_binding: Device supports VK_EXT_descriptor_buffer! +1414.312:00d0:0124:info:vkd3d-proton:d3d12_device_caps_init_shader_model: Enabling support for SM 6.6. +1414.312:00d0:0124:fixme:vkd3d-proton:d3d12_device_caps_init_feature_options1: TotalLaneCount = 2432, may be inaccurate. +1414.312:00d0:0124:info:vkd3d-proton:d3d12_device_determine_ray_tracing_tier: DXR support enabled. +1414.312:00d0:0124:info:vkd3d-proton:vkd3d_pipeline_library_init_disk_cache: Remapping VKD3D_SHADER_CACHE to: vkd3d-proton.cache. +1414.312:00d0:0124:info:vkd3d-proton:vkd3d_pipeline_library_init_disk_cache: Attempting to load disk cache from: vkd3d-proton.cache. +1414.313:00d0:0144:info:vkd3d-proton:vkd3d_pipeline_library_disk_thread_main: Performing async setup of stream archive ... +1414.313:00d0:0144:info:vkd3d-proton:vkd3d_pipeline_library_disk_cache_merge: No write cache exists. No need to merge any disk caches. +1414.313:00d0:0144:info:vkd3d-proton:vkd3d_pipeline_library_disk_cache_initial_setup: Merging pipeline libraries took 0.158 ms. +1414.313:00d0:0144:info:vkd3d-proton:vkd3d_pipeline_library_disk_cache_initial_setup: Mapping read-only cache took 0.256 ms. +1414.313:00d0:0144:info:vkd3d-proton:vkd3d_pipeline_library_disk_cache_initial_setup: Parsing stream archive took 0.031 ms. +1414.313:00d0:0144:info:vkd3d-proton:vkd3d_pipeline_library_disk_thread_main: Done performing async setup of stream archive. +1414.319:00d0:0124:fixme:vkd3d-proton:d3d12_command_queue_init: Ignoring priority 0x64. +warn: DXGIGetDebugInterface1: Stub +info: DXGI: Hiding actual GPU, reporting: +info: vendor ID: 0x1002 +info: device ID: 0x73df +1414.406:00d0:00d4:info:vkd3d-proton:dxgi_vk_swap_chain_init: Creating swapchain (1280 x 720), BufferCount = 3. +1414.416:00d0:00d4:info:vkd3d-proton:dxgi_vk_swap_chain_init_sync_objects: Ensure maximum latency of 3 frames with KHR_present_wait. +1414.416:00d0:00d4:info:vkd3d-proton:dxgi_vk_swap_chain_init_sleep_state: Timer interval is 1.0 ms. +warn: DXGI: MakeWindowAssociation: Ignoring flags +warn: DxgiOutput::WaitForVBlank: Inaccurate +info: Setting timer interval to 1000 us +1414.927:00d0:014c:info:vkd3d-proton:dxgi_vk_swap_chain_recreate_swapchain_in_present_task: Got 3 swapchain images. +1415.477:00d0:0154:fixme:vkd3d-proton:vkd3d_texture_view_desc_fixup: Remapping 2D to 2D_ARRAY. Needs Vulkan spec tightening to match D3D12 properly. +1415.500:00d0:014c:info:vkd3d-proton:dxgi_vk_swap_chain_recreate_swapchain_in_present_task: Got 3 swapchain images. diff --git a/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.stdout.run1 b/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.stdout.run1 new file mode 100644 index 0000000..83df1c0 --- /dev/null +++ b/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.stdout.run1 @@ -0,0 +1,33989 @@ +i> 000000E0 Build: canary_experimental@99fd19d02 on Jun 5 2026 +i> 000000E0 Storage root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug +i> 000000E0 ----------- CONFIG DUMP ----------- + +[APU] +apu = "any" +apu_max_queued_frames = 8 +enable_xmp = true +ffmpeg_verbose = false +mute = false +use_dedicated_xma_thread = true +xma_decoder = "new" + +[Auditing] +audit_handle_lifecycle = false +audit_jit_prolog_pc = 0 + +[CPU] +break_condition_gpr = -1 +break_condition_op = "eq" +break_condition_truncate = true +break_condition_value = 0 +break_on_debugbreak = true +break_on_instruction = 0 +break_on_start = false +break_on_unimplemented_instructions = true +clock_no_scaling = false +clock_source_raw = false +cpu = "any" +debug_symbol_loader = false +debugprint_trap_log = false +disable_context_promotion = false +disable_instruction_infocache = false +disable_prefetch_and_cachecontrol = true +disassemble_functions = false +dump_translated_hir_functions = false +elide_e0_check = false +emit_inline_mmio_checks = false +emit_mmio_aware_stores_for_recorded_exception_addresses = true +emit_source_annotations = false +enable_early_precompilation = false +full_optimization_even_with_debug = false +ignore_trap_instructions = true +ignore_undefined_externs = true +inline_loadclock = false +inline_mmio_access = true +load_module_map = "" +no_reserved_ops = false +no_round_to_single = false +permit_float_constant_evaluation = false +pvr = 7407360 +record_mmio_access_exceptions = true +store_all_context_values = false +trace_function_coverage = false +trace_function_data = false +trace_function_data_path = "" +trace_function_references = false +trace_functions = false +use_fast_dot_product = false +validate_hir = false +writable_code_segments = false + +[Config] +defaults_date = 2026040912 + +[Content] +license_mask = 0 + +[D3D12] +d3d12_adapter = -1 +d3d12_allow_variable_refresh_rate_and_tearing = true +d3d12_bindless = true +d3d12_break_on_error = false +d3d12_break_on_warning = false +d3d12_debug = false +d3d12_dxbc_disasm = false +d3d12_dxbc_disasm_dxilconv = false +d3d12_pipeline_creation_threads = -1 +d3d12_queue_priority = 1 +d3d12_submit_on_primary_buffer_end = true +d3d12_tessellation_wireframe = false + +[Display] +fullscreen = false +host_present_from_non_ui_thread = true +postprocess_antialiasing = "" +postprocess_dither = true +postprocess_ffx_cas_additional_sharpness = 0 +postprocess_ffx_fsr_max_upsampling_passes = 4 +postprocess_ffx_fsr_sharpness_reduction = 0.20000000298023224 +postprocess_scaling_and_sharpening = "" +present_letterbox = true +present_render_pass_clear = true +present_safe_area_x = 100 +present_safe_area_y = 100 + +[GPU] +anisotropic_override = -1 +async_shader_compilation = true +clear_memory_page_state = false +depth_float24_convert_in_pixel_shader = false +depth_float24_round = false +depth_transfer_not_equal_test = true +disassemble_pm4 = false +draw_resolution_scale_x = 1 +draw_resolution_scale_y = 1 +draw_resolution_scaled_texture_offsets = true +dump_shaders = "" +dxbc_source_map = false +dxbc_switch = true +execute_unclipped_draw_vs_on_cpu = true +execute_unclipped_draw_vs_on_cpu_for_psi_render_backend = true +execute_unclipped_draw_vs_on_cpu_with_scissor = false +force_convert_line_loops_to_strips = false +force_convert_quad_lists_to_triangle_lists = false +force_convert_triangle_fans_to_lists = false +framerate_limit = 0 +gamma_render_target_as_unorm16 = true +gpu = "any" +gpu_3d_to_2d_texture = true +gpu_allow_invalid_fetch_constants = true +gpu_allow_invalid_upload_range = false +half_pixel_offset = true +ignore_32bit_vertex_index_support = false +log_guest_driven_gpu_register_written_values = false +log_ringbuffer_kickoff_initiator_bts = false +mrt_edram_used_range_clamp_to_min = true +native_2x_msaa = true +native_stencil_value_output = true +native_stencil_value_output_d3d12_intel = false +no_discard_stencil_in_transfer_pipelines = false +non_seamless_cube_map = true +occlusion_query = "fast" +occlusion_query_fake_lower_threshold = 80 +occlusion_query_fake_upper_threshold = 100 +occlusion_query_querybatch_range = 0 +occlusion_query_saturation = 1 +primitive_processor_cache_min_indices = 4096 +readback_memexport = false +readback_resolve = "none" +render_target_path_d3d12 = "" +render_target_path_vulkan = "" +resolve_resolution_scale_fill_half_pixel_offset = true +snorm16_render_target_full_range = true +store_shaders = true +target_trace_file = "" +texture_cache_memory_limit_hard = 768 +texture_cache_memory_limit_render_to_texture = 24 +texture_cache_memory_limit_soft = 384 +texture_cache_memory_limit_soft_lifetime = 30 +tiled_shared_memory = true +trace_dump_path = "" +trace_gpu_prefix = "scratch/gpu/" +trace_gpu_stream = false +use_fuzzy_alpha_epsilon = false +vsync = true + +[General] +allow_game_relative_writes = false +allow_plugins = false +apply_patches = true +controller_hotkeys = false +debug = false +disable_doubleclick_fullscreen = false +discord = true +launch_module = "" +notification_sound_path = "" +priority_class = 0 +recent_titles_entry_amount = 10 +time_scalar = 1 + +[HACKS] +ac6_ground_fix = false + +[HID] +guide_button = true +hid = "any" +keyboard_mode = 0 +keyboard_user_index = 0 +left_stick_deadzone_percentage = 0 +right_stick_deadzone_percentage = 0 +vibration = true + +[HID.WinKey] +keybind_a = "0xBA" +keybind_b = "0xDE" +keybind_back = "Z" +keybind_dpad_down = "^S" +keybind_dpad_left = "^A" +keybind_dpad_right = "^D" +keybind_dpad_up = "^W" +keybind_guide = "0x08" +keybind_left_shoulder = "1" +keybind_left_thumb = "F" +keybind_left_thumb_down = "_S" +keybind_left_thumb_left = "_A" +keybind_left_thumb_right = "_D" +keybind_left_thumb_up = "_W" +keybind_left_trigger = "Q I" +keybind_right_shoulder = "3" +keybind_right_thumb = "K" +keybind_right_thumb_down = "0x28" +keybind_right_thumb_left = "0x25" +keybind_right_thumb_right = "0x27" +keybind_right_thumb_up = "0x26" +keybind_right_trigger = "E O" +keybind_start = "X" +keybind_x = "L" +keybind_y = "P" + +[Kernel] +allow_avatar_initialization = false +allow_incompatible_title_update = true +apply_title_update = true +cl = "" +console_type = 0 +default_achievements_backend = "GPD" +ignore_thread_affinities = true +ignore_thread_priorities = false +kernel_build_version = 1888 +kernel_cert_monitor = false +kernel_debug_monitor = false +kernel_display_gamma_power = 2.22222233 +kernel_display_gamma_type = 2 +kernel_pix = false +staging_mode = false + +[Logging] +enable_console = false +flush_log = true +log_file = "" +log_high_frequency_kernel_calls = false +log_level = 2 +log_mask = 0 +log_string_format_kernel_calls = false +log_to_debugprint = false +log_to_stdout = true + +[Memory] +ignore_offset_for_ranged_allocations = false +protect_on_release = false +protect_zero = true +scribble_heap = false +scribble_heap_value = 0 +writable_executable_memory = true + +[Profiles] +logged_profile_slot_0_xuid = "" +logged_profile_slot_1_xuid = "" +logged_profile_slot_2_xuid = "" +logged_profile_slot_3_xuid = "" + +[SDL] +mappings_file = "gamecontrollerdb.txt" + +[Storage] +cache_root = "" +content_root = "" +force_mount_devkit = false +mount_cache = true +mount_memory_unit = false +mount_scratch = false +storage_root = "" + +[UI] +custom_font_path = "" +font_size = 14 +headless = false +imgui_debug = false +profiler_dpi_scaling = false +show_achievement_notification = false +show_profiler = false +storage_selection_dialog = false +window_size_x = 1280 +window_size_y = 720 + +[Video] +avpack = 8 +custom_internal_display_resolution_x = 0 +custom_internal_display_resolution_y = 0 +enable_3d_mode = false +interlaced = false + +[Vulkan] +vulkan_allow_present_mode_fifo_relaxed = true +vulkan_allow_present_mode_immediate = true +vulkan_allow_present_mode_mailbox = true +vulkan_device = -1 +vulkan_log_debug_messages = true +vulkan_pipeline_creation_threads = -1 +vulkan_semaphore_reuse_workaround = false +vulkan_sparse_shared_memory = true +vulkan_validation = false + +[Win32] +win32_high_resolution_timer = true +win32_mmcss = true + +[x64] +align_all_basic_blocks = 0 +delay_via_maybeyield = false +enable_host_guest_stack_synchronization = true +enable_incorrect_roundingmode_behavior = false +enable_rmw_context_merging = false +instrument_call_times = false +max_stackpoints = 65536 +x64_extension_mask = -1 +xop_arithmetic_right_shifts = false +xop_compares = true +xop_left_shifts = false +xop_right_shifts = false +xop_rotates = false +----------- END OF CONFIG DUMP ---- +i> 000000E0 Loaded config: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\xenia-canary.config.toml +i> 000000E0 Content root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\content +i> 000000E0 Host cache root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\cache_host +w> 000000E0 Unable to load Japanese font; JP characters will be boxes +w> 000000E0 Unable to load Japanese font; JP characters will be boxes +i> 0000013C Setup: Initializing Memory... +i> 0000013C Setup: Initializing Exports... +i> 0000013C Setup: Initializing Processor... +i> 0000013C Setup: Initializing Audio... +i> 0000013C Setup: Initializing Graphics... +i> 0000013C Setup: Initializing HID... +i> 0000013C winkey: "0x08" binds key 0x8 to controller input GUIDE. +i> 0000013C winkey: "^A" binds key 0x41 to controller input DPAD_LEFT. +i> 0000013C winkey: "^D" binds key 0x44 to controller input DPAD_RIGHT. +i> 0000013C winkey: "^S" binds key 0x53 to controller input DPAD_DOWN. +i> 0000013C winkey: "^W" binds key 0x57 to controller input DPAD_UP. +i> 0000013C winkey: "_A" binds key 0x41 to controller input LEFT_THUMB_LEFT. +i> 0000013C winkey: "_D" binds key 0x44 to controller input LEFT_THUMB_RIGHT. +i> 0000013C winkey: "_S" binds key 0x53 to controller input LEFT_THUMB_DOWN. +i> 0000013C winkey: "_W" binds key 0x57 to controller input LEFT_THUMB_UP. +i> 0000013C winkey: "F" binds key 0x46 to controller input LEFT_THUMB_PRESSED. +i> 0000013C winkey: "0x26" binds key 0x26 to controller input RIGHT_THUMB_UP. +i> 0000013C winkey: "0x28" binds key 0x28 to controller input RIGHT_THUMB_DOWN. +i> 0000013C winkey: "0x27" binds key 0x27 to controller input RIGHT_THUMB_RIGHT. +i> 0000013C winkey: "0x25" binds key 0x25 to controller input RIGHT_THUMB_LEFT. +i> 0000013C winkey: "K" binds key 0x4B to controller input RIGHT_THUMB_PRESSED. +i> 0000013C winkey: "L" binds key 0x4C to controller input X. +i> 0000013C winkey: "0xDE" binds key 0xDE to controller input B. +i> 0000013C winkey: "0xBA" binds key 0xBA to controller input A. +i> 0000013C winkey: "P" binds key 0x50 to controller input Y. +i> 0000013C winkey: "Q" binds key 0x51 to controller input LEFT_TRIGGER. +i> 0000013C winkey: "I" binds key 0x49 to controller input LEFT_TRIGGER. +i> 0000013C winkey: "E" binds key 0x45 to controller input RIGHT_TRIGGER. +i> 0000013C winkey: "O" binds key 0x4F to controller input RIGHT_TRIGGER. +i> 0000013C winkey: "Z" binds key 0x5A to controller input BACK. +i> 0000013C winkey: "X" binds key 0x58 to controller input START. +i> 0000013C winkey: "1" binds key 0x31 to controller input LEFT_SHOULDER. +i> 0000013C winkey: "3" binds key 0x33 to controller input RIGHT_SHOULDER. +i> 000000E0 SDL Version 2.32.2 initialized. +w> 000000E0 SDL GameControllerDB: file 'gamecontrollerdb.txt' does not exist. +i> 0000013C Setup: Initializing VFS... +i> 0000013C PatchDB: Loaded patches for 0 titles +i> 0000013C Setup: Initializing Kernel... +i> 0000013C ProfileManager: Found 0 Profiles +w> 0000013C BaseHeap::AllocFixed attempting commit on unreserved page +w> 0000013C BaseHeap::AllocFixed attempting commit on unreserved page +i> 0000013C Setup: Starting graphics_system... +i> 0000013C DXGI adapter: NVIDIA GeForce GTX 1070 Ti (vendor 0x1002, device 0x73DF) +i> 0000013C Direct3D 12 device and OS features: +* Max GPU virtual address bits per resource: 40 +* Non-zeroed heap creation: yes +* Pixel-shader-specified stencil reference: no +* Programmable sample positions: tier 0 +* Rasterizer-ordered views: yes +* Resource binding: tier 3 +* Tiled resources: tier 4 +* Unaligned block-compressed textures: yes +i> 0000013C XThread01000010 (1) Stack: 70010000-70030000 +i> 0000013C XThread01000014 (2) Stack: 70050000-70070000 +i> 0000013C Setup: Starting audio_system... +K> 01000010 XThread::Execute thid 1 (handle=01000010, 'GPU Commands (01000010)', native=0000016C, ) +K> 01000014 XThread::Execute thid 2 (handle=01000014, 'GPU Frame limiter (01000014)', native=00000170, ) +i> 0000013C XThread01000018 (3) Stack: 70090000-700B0000 +i> 0000013C XThread0100001C (4) Stack: 700D0000-700F0000 +K> 01000018 XThread::Execute thid 3 (handle=01000018, 'XMA Decoder (01000018)', native=00000198, ) +K> 0100001C XThread::Execute thid 4 (handle=0100001C, 'Audio Worker (0100001C)', native=0000019C, ) +i> 000000E0 Checking for XISO +F> 000000E0 DiscImageDevice::Initialize +i> 000000E0 Checking for XISO +F> 000000E0 DiscImageDevice::Initialize +F> 000000E0 DiscImageDevice::Initialize +i> 000000E0 Loading module GAME:\default.xex +F> 000000E0 DiscImageDevice::ResolvePath(\default.xex) +i> 000000E0 Module \Device\Cdrom0\default.xex: +Module Hash: CCF935D24A74E002 + Module Flags: 00000001 + XEX_MODULE_TITLE +Security Header: + Image Flags: 00000008 + XEX_IMAGE_XGD2_MEDIA_ONLY + Load Address: 82000000 + Image Size: 00920000 + Export Table: 00000000 +Optional Header Count: 15 + XEX_HEADER_RESOURCE_INFO: + 535107D4 828FB900-8291D8CF, 139215b + XEX_HEADER_FILE_FORMAT_INFO: + Info Size: 36 + Encryption Type: Normal + Compression Type: Normal + Window Size: 32768 + Block Size: 61440 + Block Hash: B3 2B D7 D4 EF 96 9A C5 9F D7 77 C6 8A 99 AA 1C BD 87 1C BE 00 90 2E F1 46 3F A3 D7 00 00 00 10 + XEX_HEADER_ENTRY_POINT: 824AB748 + XEX_HEADER_IMAGE_BASE_ADDRESS: 82000000 + XEX_HEADER_IMPORT_LIBRARIES: + xam.xex - 104 imports + Version: 2.0.4552.0 + Min Version: 2.0.4552.0 + xboxkrnl.exe - 294 imports + Version: 2.0.4552.0 + Min Version: 2.0.4552.0 + XEX_HEADER_CHECKSUM_TIMESTAMP: + Checksum : 00902EF1 + Time Stamp: 463FA3D7 - Tue May 8 00:10:31 2007 + XEX_HEADER_ORIGINAL_PE_NAME: default.pe + XEX_HEADER_STATIC_LIBRARIES: + XAPILIB : 2.0.3215.0 + D3D9 : 2.0.3215.1 + D3DX9 : 2.0.3215.0 + XBOXKRNL : 2.0.3215.0 + XAUD : 2.0.3215.0 + LIBCPMT : 2.0.3215.0 + XMP : 2.0.3215.0 + XMEDIA : 2.0.3215.0 + XONLINE : 2.0.3215.0 + XGRAPHC : 2.0.3215.0 + X3DAUD : 2.0.3215.1 + XACT : 2.0.3215.1 + XEX_HEADER_TLS_INFO: + Slot Count: 64 + Raw Data Address: 00000000 + Data Size: 0 + Raw Data Size: 0 + XEX_HEADER_DEFAULT_STACK_SIZE: 524288 + XEX_HEADER_SYSTEM_FLAGS: 00000400 + XEX_SYSTEM_PAL50_INCOMPATIBLE + XEX_HEADER_EXECUTION_INFO: + Media ID: 2D2E2EEB + Title ID: 535107D4 + Savegame ID: 535107D4 + Disc Number / Total: 1 / 1 + XEX_HEADER_GAME_RATINGS: + ESRB: Teen + PEGI: 12+ + PEGI-FI: 11+ + PEGI - PT: 12+ + BBFC: 12+ + CERO: Unrated + USK: Approved for children aged 12 and above + OFLC - AU: Parental Guidance + OFLC - NZ: Parental Guidance + KMRB: Unrated + Brazil: Unrated + FPB: 13+ + XEX_HEADER_LAN_KEY: E0 3C EA 47 3C AE 06 62 98 8F DB 7F 58 50 12 38 + XEX_HEADER_XBOX360_LOGO: + Section Size: 1736 + Logo Size: 1728 +Sections: + 0 RODATA 1 pages 82000000 - 82010000 (65536 bytes) + 1 RODATA 1 pages 82010000 - 82020000 (65536 bytes) + 2 RODATA 1 pages 82020000 - 82030000 (65536 bytes) + 3 RODATA 1 pages 82030000 - 82040000 (65536 bytes) + 4 RODATA 1 pages 82040000 - 82050000 (65536 bytes) + 5 RODATA 1 pages 82050000 - 82060000 (65536 bytes) + 6 RODATA 1 pages 82060000 - 82070000 (65536 bytes) + 7 RODATA 1 pages 82070000 - 82080000 (65536 bytes) + 8 RODATA 1 pages 82080000 - 82090000 (65536 bytes) + 9 RODATA 1 pages 82090000 - 820A0000 (65536 bytes) + 10 RODATA 1 pages 820A0000 - 820B0000 (65536 bytes) + 11 RODATA 1 pages 820B0000 - 820C0000 (65536 bytes) + 12 RODATA 1 pages 820C0000 - 820D0000 (65536 bytes) + 13 RODATA 1 pages 820D0000 - 820E0000 (65536 bytes) + 14 RODATA 1 pages 820E0000 - 820F0000 (65536 bytes) + 15 RODATA 1 pages 820F0000 - 82100000 (65536 bytes) + 16 RODATA 1 pages 82100000 - 82110000 (65536 bytes) + 17 RODATA 1 pages 82110000 - 82120000 (65536 bytes) + 18 RODATA 1 pages 82120000 - 82130000 (65536 bytes) + 19 RODATA 1 pages 82130000 - 82140000 (65536 bytes) + 20 RODATA 1 pages 82140000 - 82150000 (65536 bytes) + 21 CODE 1 pages 82150000 - 82160000 (65536 bytes) + 22 CODE 1 pages 82160000 - 82170000 (65536 bytes) + 23 CODE 1 pages 82170000 - 82180000 (65536 bytes) + 24 CODE 1 pages 82180000 - 82190000 (65536 bytes) + 25 CODE 1 pages 82190000 - 821A0000 (65536 bytes) + 26 CODE 1 pages 821A0000 - 821B0000 (65536 bytes) + 27 CODE 1 pages 821B0000 - 821C0000 (65536 bytes) + 28 CODE 1 pages 821C0000 - 821D0000 (65536 bytes) + 29 CODE 1 pages 821D0000 - 821E0000 (65536 bytes) + 30 CODE 1 pages 821E0000 - 821F0000 (65536 bytes) + 31 CODE 1 pages 821F0000 - 82200000 (65536 bytes) + 32 CODE 1 pages 82200000 - 82210000 (65536 bytes) + 33 CODE 1 pages 82210000 - 82220000 (65536 bytes) + 34 CODE 1 pages 82220000 - 82230000 (65536 bytes) + 35 CODE 1 pages 82230000 - 82240000 (65536 bytes) + 36 CODE 1 pages 82240000 - 82250000 (65536 bytes) + 37 CODE 1 pages 82250000 - 82260000 (65536 bytes) + 38 CODE 1 pages 82260000 - 82270000 (65536 bytes) + 39 CODE 1 pages 82270000 - 82280000 (65536 bytes) + 40 CODE 1 pages 82280000 - 82290000 (65536 bytes) + 41 CODE 1 pages 82290000 - 822A0000 (65536 bytes) + 42 CODE 1 pages 822A0000 - 822B0000 (65536 bytes) + 43 CODE 1 pages 822B0000 - 822C0000 (65536 bytes) + 44 CODE 1 pages 822C0000 - 822D0000 (65536 bytes) + 45 CODE 1 pages 822D0000 - 822E0000 (65536 bytes) + 46 CODE 1 pages 822E0000 - 822F0000 (65536 bytes) + 47 CODE 1 pages 822F0000 - 82300000 (65536 bytes) + 48 CODE 1 pages 82300000 - 82310000 (65536 bytes) + 49 CODE 1 pages 82310000 - 82320000 (65536 bytes) + 50 CODE 1 pages 82320000 - 82330000 (65536 bytes) + 51 CODE 1 pages 82330000 - 82340000 (65536 bytes) + 52 CODE 1 pages 82340000 - 82350000 (65536 bytes) + 53 CODE 1 pages 82350000 - 82360000 (65536 bytes) + 54 CODE 1 pages 82360000 - 82370000 (65536 bytes) + 55 CODE 1 pages 82370000 - 82380000 (65536 bytes) + 56 CODE 1 pages 82380000 - 82390000 (65536 bytes) + 57 CODE 1 pages 82390000 - 823A0000 (65536 bytes) + 58 CODE 1 pages 823A0000 - 823B0000 (65536 bytes) + 59 CODE 1 pages 823B0000 - 823C0000 (65536 bytes) + 60 CODE 1 pages 823C0000 - 823D0000 (65536 bytes) + 61 CODE 1 pages 823D0000 - 823E0000 (65536 bytes) + 62 CODE 1 pages 823E0000 - 823F0000 (65536 bytes) + 63 CODE 1 pages 823F0000 - 82400000 (65536 bytes) + 64 CODE 1 pages 82400000 - 82410000 (65536 bytes) + 65 CODE 1 pages 82410000 - 82420000 (65536 bytes) + 66 CODE 1 pages 82420000 - 82430000 (65536 bytes) + 67 CODE 1 pages 82430000 - 82440000 (65536 bytes) + 68 CODE 1 pages 82440000 - 82450000 (65536 bytes) + 69 CODE 1 pages 82450000 - 82460000 (65536 bytes) + 70 CODE 1 pages 82460000 - 82470000 (65536 bytes) + 71 CODE 1 pages 82470000 - 82480000 (65536 bytes) + 72 CODE 1 pages 82480000 - 82490000 (65536 bytes) + 73 CODE 1 pages 82490000 - 824A0000 (65536 bytes) + 74 CODE 1 pages 824A0000 - 824B0000 (65536 bytes) + 75 CODE 1 pages 824B0000 - 824C0000 (65536 bytes) + 76 CODE 1 pages 824C0000 - 824D0000 (65536 bytes) + 77 CODE 1 pages 824D0000 - 824E0000 (65536 bytes) + 78 CODE 1 pages 824E0000 - 824F0000 (65536 bytes) + 79 CODE 1 pages 824F0000 - 82500000 (65536 bytes) + 80 CODE 1 pages 82500000 - 82510000 (65536 bytes) + 81 CODE 1 pages 82510000 - 82520000 (65536 bytes) + 82 CODE 1 pages 82520000 - 82530000 (65536 bytes) + 83 CODE 1 pages 82530000 - 82540000 (65536 bytes) + 84 CODE 1 pages 82540000 - 82550000 (65536 bytes) + 85 CODE 1 pages 82550000 - 82560000 (65536 bytes) + 86 CODE 1 pages 82560000 - 82570000 (65536 bytes) + 87 CODE 1 pages 82570000 - 82580000 (65536 bytes) + 88 CODE 1 pages 82580000 - 82590000 (65536 bytes) + 89 CODE 1 pages 82590000 - 825A0000 (65536 bytes) + 90 CODE 1 pages 825A0000 - 825B0000 (65536 bytes) + 91 CODE 1 pages 825B0000 - 825C0000 (65536 bytes) + 92 CODE 1 pages 825C0000 - 825D0000 (65536 bytes) + 93 CODE 1 pages 825D0000 - 825E0000 (65536 bytes) + 94 CODE 1 pages 825E0000 - 825F0000 (65536 bytes) + 95 CODE 1 pages 825F0000 - 82600000 (65536 bytes) + 96 CODE 1 pages 82600000 - 82610000 (65536 bytes) + 97 CODE 1 pages 82610000 - 82620000 (65536 bytes) + 98 CODE 1 pages 82620000 - 82630000 (65536 bytes) + 99 CODE 1 pages 82630000 - 82640000 (65536 bytes) + 100 CODE 1 pages 82640000 - 82650000 (65536 bytes) + 101 CODE 1 pages 82650000 - 82660000 (65536 bytes) + 102 CODE 1 pages 82660000 - 82670000 (65536 bytes) + 103 CODE 1 pages 82670000 - 82680000 (65536 bytes) + 104 CODE 1 pages 82680000 - 82690000 (65536 bytes) + 105 CODE 1 pages 82690000 - 826A0000 (65536 bytes) + 106 CODE 1 pages 826A0000 - 826B0000 (65536 bytes) + 107 CODE 1 pages 826B0000 - 826C0000 (65536 bytes) + 108 CODE 1 pages 826C0000 - 826D0000 (65536 bytes) + 109 CODE 1 pages 826D0000 - 826E0000 (65536 bytes) + 110 CODE 1 pages 826E0000 - 826F0000 (65536 bytes) + 111 CODE 1 pages 826F0000 - 82700000 (65536 bytes) + 112 CODE 1 pages 82700000 - 82710000 (65536 bytes) + 113 CODE 1 pages 82710000 - 82720000 (65536 bytes) + 114 CODE 1 pages 82720000 - 82730000 (65536 bytes) + 115 CODE 1 pages 82730000 - 82740000 (65536 bytes) + 116 CODE 1 pages 82740000 - 82750000 (65536 bytes) + 117 CODE 1 pages 82750000 - 82760000 (65536 bytes) + 118 CODE 1 pages 82760000 - 82770000 (65536 bytes) + 119 CODE 1 pages 82770000 - 82780000 (65536 bytes) + 120 CODE 1 pages 82780000 - 82790000 (65536 bytes) + 121 CODE 1 pages 82790000 - 827A0000 (65536 bytes) + 122 CODE 1 pages 827A0000 - 827B0000 (65536 bytes) + 123 CODE 1 pages 827B0000 - 827C0000 (65536 bytes) + 124 CODE 1 pages 827C0000 - 827D0000 (65536 bytes) + 125 CODE 1 pages 827D0000 - 827E0000 (65536 bytes) + 126 CODE 1 pages 827E0000 - 827F0000 (65536 bytes) + 127 CODE 1 pages 827F0000 - 82800000 (65536 bytes) + 128 CODE 1 pages 82800000 - 82810000 (65536 bytes) + 129 CODE 1 pages 82810000 - 82820000 (65536 bytes) + 130 CODE 1 pages 82820000 - 82830000 (65536 bytes) + 131 CODE 1 pages 82830000 - 82840000 (65536 bytes) + 132 CODE 1 pages 82840000 - 82850000 (65536 bytes) + 133 CODE 1 pages 82850000 - 82860000 (65536 bytes) + 134 CODE 1 pages 82860000 - 82870000 (65536 bytes) + 135 RWDATA 1 pages 82870000 - 82880000 (65536 bytes) + 136 RWDATA 1 pages 82880000 - 82890000 (65536 bytes) + 137 RWDATA 1 pages 82890000 - 828A0000 (65536 bytes) + 138 RWDATA 1 pages 828A0000 - 828B0000 (65536 bytes) + 139 RWDATA 1 pages 828B0000 - 828C0000 (65536 bytes) + 140 RWDATA 1 pages 828C0000 - 828D0000 (65536 bytes) + 141 RWDATA 1 pages 828D0000 - 828E0000 (65536 bytes) + 142 RWDATA 1 pages 828E0000 - 828F0000 (65536 bytes) + 143 RWDATA 1 pages 828F0000 - 82900000 (65536 bytes) + 144 RWDATA 1 pages 82900000 - 82910000 (65536 bytes) + 145 RWDATA 1 pages 82910000 - 82920000 (65536 bytes) +Imports: + xam - 52 imports + Version: 0.0.4552.32 + Min Version: 0.0.4552.32 + + Total: 52 + Known: 100% (52 known, 0 unknown) + Implemented: 98% (51 implemented, 1 unimplemented) + + F 82000600 8284DA7C 28C ( 652) XNotifyPositionUI + F 82000604 8284DA8C 2BC ( 700) XamShowSigninUI + F 82000608 8284DA9C 2C1 ( 705) XamShowKeyboardUI + F 8200060C 8284DAAC 2D5 ( 725) !! XamShowGamerCardUIForXUID + F 82000610 8284DABC 2CB ( 715) XamShowDeviceSelectorUI + F 82000614 8284DACC 2D9 ( 729) XamShowDirtyDiscErrorUI + F 82000618 8284DADC 1B3 ( 435) XamTaskShouldExit + F 8200061C 8284DAEC 1B1 ( 433) XamTaskCloseHandle + F 82000620 8284DAFC 1AF ( 431) XamTaskSchedule + F 82000624 8284DB0C 1A4 ( 420) XamLoaderLaunchTitle + F 82000628 8284DB1C 1F7 ( 503) XMsgStartIORequest + F 8200062C 8284DB2C 20E ( 526) XamUserGetName + F 82000630 8284DB3C 210 ( 528) XamUserGetSigninState + F 82000634 8284DB4C 282 ( 642) XamGetSystemVersion + F 82000638 8284DB5C 2F7 ( 759) XamUserCreateStatsEnumerator + F 8200063C 8284DB6C 2EE ( 750) XamUserCreateAchievementEnumerator + F 82000640 8284DB7C 20A ( 522) XamUserGetXUID + F 82000644 8284DB8C 250 ( 592) XamEnumerate + F 82000648 8284DB9C 3CC ( 972) XGetGameRegion + F 8200064C 8284DBAC 190 ( 400) XamInputGetCapabilities + F 82000650 8284DBBC 191 ( 401) XamInputGetState + F 82000654 8284DBCC 192 ( 402) XamInputSetState + F 82000658 8284DBDC 198 ( 408) XamInputGetKeystrokeEx + F 8200065C 8284DBEC 258 ( 600) XamContentCreate + F 82000660 8284DBFC 25B ( 603) XamContentDelete + F 82000664 8284DC0C 25A ( 602) XamContentClose + F 82000668 8284DC1C 260 ( 608) XamContentSetThumbnail + F 8200066C 8284DC2C 262 ( 610) XamContentGetCreator + F 82000670 8284DC3C 25C ( 604) XamContentCreateEnumerator + F 82000674 8284DC4C 265 ( 613) XamContentGetDeviceState + F 82000678 8284DC5C 25E ( 606) XamContentGetDeviceData + F 8200067C 8284DC6C 25F ( 607) XamContentGetDeviceName + F 82000680 8284DC7C 1A0 ( 416) XamEnableInactivityProcessing + F 82000684 8284DC8C 1A1 ( 417) XamResetInactivity + F 82000688 8284DC9C 2DC ( 732) XamShowMessageBoxUIEx + F 8200068C 8284DCAC 3CD ( 973) XGetLanguage + F 82000690 8284DCBC 3CB ( 971) XGetAVPack + F 82000694 8284DCCC 1A9 ( 425) XamLoaderTerminateTitle + F 82000698 8284DCDC 280 ( 640) XamGetExecutionId + F 8200069C 8284E45C 28B ( 651) XNotifyGetNext + F 820006A0 8284E44C 002 ( 2) NetDll_WSACleanup + F 820006A4 8284E43C 001 ( 1) NetDll_WSAStartup + F 820006A8 8284E46C 28A ( 650) XamNotifyCreateListener + F 820006AC 8284E42C 316 ( 790) XamSessionCreateHandle + F 820006B0 8284E41C 317 ( 791) XamSessionRefObjByHandle + F 820006B4 8284E40C 21A ( 538) XamUserWriteProfileSettings + F 820006B8 8284E3FC 219 ( 537) XamUserReadProfileSettings + F 820006BC 8284E3EC 1EA ( 490) XamAlloc + F 820006C0 8284E3DC 1EC ( 492) XamFree + F 820006C4 8284E3CC 3D1 ( 977) XGetVideoMode + F 820006C8 8284E3BC 1F4 ( 500) XMsgInProcessCall + F 820006CC 8284E3AC 1FC ( 508) XMsgStartIORequestEx + + xboxkrnl - 152 imports + Version: 0.0.4552.32 + Min Version: 0.0.4552.32 + + Total: 152 + Known: 100% (152 known, 0 unknown) + Implemented: 95% (145 implemented, 7 unimplemented) + + F 820006D4 8284E1FC 0B4 ( 180) KfReleaseSpinLock + F 820006D8 8284E20C 0B1 ( 177) KfAcquireSpinLock + F 820006DC 8284E21C 1DF ( 479) KiApcNormalRoutineNop + F 820006E0 8284E22C 1B6 ( 438) VdEnableRingBufferRPtrWriteBack + F 820006E4 8284E23C 1C3 ( 451) VdInitializeRingBuffer + F 820006E8 8284E24C 0BE ( 190) MmGetPhysicalAddress + F 820006EC 8284E25C 1D9 ( 473) VdSetSystemCommandBufferGpuIdentifierAddress + F 820006F0 8284E26C 13B ( 315) sprintf + F 820006F4 8284E27C 1B9 ( 441) VdGetCurrentDisplayGamma + V 820006F8 266 ( 614) KeCertMonitorData + F 820006FC 8284E28C 14D ( 333) _vsnprintf + V 82000700 158 ( 344) XboxKrnlVersion + F 82000704 8284E29C 1DC ( 476) VdShutdownEngines + F 82000708 8284E2AC 1CA ( 458) VdQueryVideoMode + F 8200070C 8284E2BC 1BA ( 442) VdGetCurrentDisplayInformation + F 82000710 8284E2CC 1D3 ( 467) VdSetDisplayMode + F 82000714 8284E2DC 1D5 ( 469) VdSetGraphicsInterruptCallback + F 82000718 8284E2EC 1C2 ( 450) VdInitializeEngines + F 8200071C 8284E2FC 1C6 ( 454) VdIsHSIOTrainingSucceeded + F 82000720 8284E30C 1C9 ( 457) VdQueryVideoFlags + F 82000724 8284E31C 1B1 ( 433) VdCallGraphicsNotificationRoutines + V 82000728 1C0 ( 448) VdGpuClockInMHz + F 8200072C 8284E32C 1C5 ( 453) VdInitializeScalerCommandBuffer + F 82000730 8284E33C 269 ( 617) VdRetrainEDRAM + F 82000734 8284E34C 26A ( 618) VdRetrainEDRAMWorker + V 82000738 1C1 ( 449) VdHSIOCalibrationLock + F 8200073C 8284E35C 06B ( 107) KeLockL2 + F 82000740 8284E36C 06C ( 108) KeUnlockL2 + F 82000744 8284E37C 1C7 ( 455) VdPersistDisplay + F 82000748 8284E38C 25B ( 603) VdSwap + F 8200074C 8284E39C 1BD ( 445) VdGetSystemCommandBuffer + V 82000750 1BE ( 446) VdGlobalDevice + F 82000754 8284E1EC 04D ( 77) KeAcquireSpinLockAtRaisedIrql + F 82000758 8284E1DC 089 ( 137) KeReleaseSpinLockFromRaisedIrql + F 8200075C 8284E1CC 1B4 ( 436) VdEnableDisableClockGating + F 82000760 8284E1BC 13F ( 319) RtlTimeFieldsToTime + F 82000764 8284E1AC 136 ( 310) RtlRaiseException + F 82000768 8284E19C 0EE ( 238) NtQueryVirtualMemory + F 8200076C 8284E18C 11B ( 283) RtlCompareMemoryUlong + F 82000770 8284E17C 066 ( 102) KeGetCurrentProcessType + F 82000774 8284E16C 053 ( 83) KeBugCheckEx + F 82000778 8284E15C 126 ( 294) RtlFillMemoryUlong + V 8200077C 1AE ( 430) ExLoadedCommandLine + F 82000780 8284E14C 05A ( 90) KeDelayExecutionThread + F 82000784 8284E13C 143 ( 323) RtlUnicodeToMultiByteN + F 82000788 8284E12C 0E4 ( 228) NtQueryDirectoryFile + F 8200078C 8284E10C 019 ( 25) ExTerminateThread + F 82000790 8284E0FC 09B ( 155) KeSetCurrentStackPointers + F 82000794 8284E0EC 197 ( 407) XexGetProcedureAddress + F 82000798 8284E0DC 03C ( 60) !! IoDismountVolumeByFileHandle + F 8200079C 8284E0CC 0D9 ( 217) NtDeviceIoControlFile + F 820007A0 8284E0BC 028 ( 40) HalReturnToFirmware + F 820007A4 8284E0AC 003 ( 3) DbgPrint + F 820007A8 8284E09C 140 ( 320) RtlTimeToTimeFields + F 820007AC 8284E08C 0FE ( 254) NtWaitForMultipleObjectsEx + F 820007B0 8284E07C 0F3 ( 243) NtReleaseSemaphore + F 820007B4 8284E06C 0D5 ( 213) NtCreateSemaphore + F 820007B8 8284E05C 084 ( 132) KeQuerySystemTime + F 820007BC 8284E04C 0E8 ( 232) NtQueryInformationFile + F 820007C0 8284E03C 0F7 ( 247) NtSetInformationFile + F 820007C4 8284E02C 0FD ( 253) NtWaitForSingleObjectEx + F 820007C8 8284E01C 0CE ( 206) NtClearEvent + F 820007CC 8284E00C 0F5 ( 245) NtResumeThread + V 820007D0 0AD ( 173) KeTimeStampBundle + F 820007D4 8284DFFC 010 ( 16) ExGetXConfigSetting + V 820007D8 059 ( 89) KeDebugMonitorData + F 820007DC 8284DFEC 097 ( 151) KeSetAffinityThread + F 820007E0 8284DFDC 0FC ( 252) NtSuspendThread + F 820007E4 8284DFCC 081 ( 129) KeQueryBasePriorityThread + V 820007E8 01B ( 27) ExThreadObjectType + F 820007EC 8284DFBC 110 ( 272) ObReferenceObjectByHandle + F 820007F0 8284DFAC 099 ( 153) KeSetBasePriorityThread + F 820007F4 8284DF9C 10B ( 267) ObLookupThreadByThreadId + F 820007F8 8284DF8C 10E ( 270) ObOpenObjectByPointer + F 820007FC 8284DF7C 0DA ( 218) NtDuplicateObject + F 82000800 8284DF6C 101 ( 257) NtYieldExecution + F 82000804 8284DF5C 0F6 ( 246) NtSetEvent + F 82000808 8284DF4C 052 ( 82) KeBugCheck + F 8200080C 8284DF3C 0BC ( 188) MmDeleteKernelStack + F 82000810 8284DF2C 0BB ( 187) MmCreateKernelStack + F 82000814 8284DF1C 0D1 ( 209) NtCreateEvent + F 82000818 8284DF0C 135 ( 309) RtlNtStatusToDosError + F 8200081C 8284DEFC 194 ( 404) XexCheckExecutablePrivilege + F 82000820 8284DEEC 05F ( 95) KeEnterCriticalRegion + F 82000824 8284DEDC 07D ( 125) KeLeaveCriticalRegion + F 82000828 8284DECC 0CC ( 204) NtAllocateVirtualMemory + F 8200082C 8284DEBC 259 ( 601) !! StfsCreateDevice + F 82000830 8284DEAC 103 ( 259) ObCreateSymbolicLink + F 82000834 8284DE9C 25A ( 602) !! StfsControlDevice + F 82000838 8284DE8C 0DB ( 219) NtFlushBuffersFile + F 8200083C 8284DE7C 104 ( 260) ObDeleteSymbolicLink + F 82000840 8284DE6C 105 ( 261) ObDereferenceObject + F 82000844 8284DE5C 0DC ( 220) NtFreeVirtualMemory + F 82000848 8284DE4C 0D2 ( 210) NtCreateFile + F 8200084C 8284DE3C 256 ( 598) XeKeysConsolePrivateKeySign + F 82000850 8284DE2C 0F0 ( 240) NtReadFile + F 82000854 8284DE1C 0FF ( 255) NtWriteFile + F 82000858 8284DE0C 192 ( 402) XeCryptSha + F 8200085C 8284DDFC 257 ( 599) !! XeKeysConsoleSignatureVerification + F 82000860 8284DDEC 015 ( 21) ExRegisterTitleTerminateNotification + F 82000864 8284DDDC 09D ( 157) KeSetEvent + F 82000868 8284DDCC 0B0 ( 176) KeWaitForSingleObject + F 8200086C 8284DDBC 08F ( 143) KeResetEvent + V 82000870 193 ( 403) XexExecutableModuleHandle + F 82000874 8284DDAC 12B ( 299) RtlImageXexHeaderField + F 82000878 8284DD9C 1A5 ( 421) !! __C_specific_handler + F 8200087C 8284DD8C 12C ( 300) RtlInitAnsiString + F 82000880 8284DD7C 0DF ( 223) NtOpenFile + F 82000884 8284DD6C 0CF ( 207) NtClose + F 82000888 8284DD5C 0EF ( 239) NtQueryVolumeInformationFile + F 8200088C 8284DD4C 0C4 ( 196) MmQueryAddressProtect + F 82000890 8284DD3C 0BD ( 189) MmFreePhysicalMemory + F 82000894 8284DD2C 0BA ( 186) MmAllocatePhysicalMemoryEx + F 82000898 8284DD1C 12E ( 302) RtlInitializeCriticalSection + F 8200089C 8284DD0C 130 ( 304) RtlLeaveCriticalSection + F 820008A0 8284DCFC 125 ( 293) RtlEnterCriticalSection + F 820008A4 8284DCEC 12F ( 303) RtlInitializeCriticalSectionAndSpinCount + F 820008A8 8284E11C 00D ( 13) ExCreateThread + F 820008AC 8284E47C 085 ( 133) KeRaiseIrqlToDpcLevel + F 820008B0 8284E48C 0B3 ( 179) KfLowerIrql + F 820008B4 8284E49C 088 ( 136) KeReleaseSemaphore + F 820008B8 8284E4AC 1F8 ( 504) XAudioGetVoiceCategoryVolume + F 820008BC 8284E4BC 1F7 ( 503) XAudioGetVoiceCategoryVolumeChangeMask + F 820008C0 8284E4CC 0AF ( 175) KeWaitForMultipleObjects + F 820008C4 8284E4DC 092 ( 146) KeResumeThread + F 820008C8 8284E4EC 074 ( 116) KeInitializeSemaphore + F 820008CC 8284E4FC 226 ( 550) XMAReleaseContext + F 820008D0 8284E50C 224 ( 548) XMACreateContext + F 820008D4 8284E51C 083 ( 131) KeQueryPerformanceFrequency + F 820008D8 8284E52C 141 ( 321) RtlTryEnterCriticalSection + F 820008DC 8284E53C 0AE ( 174) KeTryToAcquireSpinLockAtRaisedIrql + F 820008E0 8284E54C 1F3 ( 499) XAudioRegisterRenderDriverClient + F 820008E4 8284E55C 1F4 ( 500) XAudioUnregisterRenderDriverClient + F 820008E8 8284E56C 1F5 ( 501) XAudioSubmitRenderDriverFrame + F 820008EC 8284E57C 195 ( 405) XexGetModuleHandle + F 820008F0 8284E58C 147 ( 327) !! RtlUnwind + F 820008F4 8284E59C 152 ( 338) KeTlsAlloc + F 820008F8 8284E5AC 154 ( 340) KeTlsGetValue + F 820008FC 8284E5BC 155 ( 341) KeTlsSetValue + F 82000900 8284E5CC 153 ( 339) KeTlsFree + F 82000904 8284E5DC 119 ( 281) !! RtlCaptureContext + F 82000908 8284E5EC 05D ( 93) KeEnableFpuExceptions + F 8200090C 8284E5FC 0C6 ( 198) MmQueryStatistics + F 82000910 8284E60C 0D7 ( 215) NtCreateTimer + F 82000914 8284E61C 0FA ( 250) NtSetTimerEx + F 82000918 8284E62C 0CD ( 205) NtCancelTimer + F 8200091C 8284E63C 0E7 ( 231) NtQueryFullAttributesFile + F 82000920 8284E64C 127 ( 295) RtlFreeAnsiString + F 82000924 8284E65C 142 ( 322) RtlUnicodeStringToAnsiString + F 82000928 8284E66C 12D ( 301) RtlInitUnicodeString + F 8200092C 8284E67C 133 ( 307) RtlMultiByteToUnicodeN + F 82000930 8284E68C 001 ( 1) DbgBreakPoint + +w> 000000E0 GameDatabase: Title doesn't contain XLAST data! Multiplayer functionality might be limited. +i> 000000E0 Title name: PROJECT SYLPHEED +i> 000000E0 +-------------------- ACHIEVEMENTS -------------------- ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| ID | Title | Description | Type | Gamerscore | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 1 | Space Combat Award | Received after your first space battle in the Glasner Training Area. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 2 | Schlos Base Defense Award | Received for stopping the missile attack on Schlos Base. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 3 | Aegis of the People Medal | Received for escorting all 7 refugee ships to safety. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 4 | TCAF Luna Medal | Received for bravely helping the fleet escape during the invasion of the Matisse System. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 5 | TCAF Mars Medal | Received for bravery beyond the call of duty during the escape from the Matisse System. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 6 | Soldier's Charm Amulet | Given to you by Raymond as a token of his trust. | Event | 50 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 7 | White Griffons Patch | Received by the commander and pilots of the White Griffon Squadron when it is formed. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 8 | TCAF Jupiter Medal | Received for bravery during the enemy's attack on the Alberti System. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 9 | Furious Pursuit Badge | Received for continuing attacks on the enemy and shooting down a large number of ships. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 10 | Solo Aerospace Combat Award | Received for descending into Acheron's atmosphere and engaging in combat alone. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 11 | Operation Nebula Blaze Award | Received for completing the extremely hazardous Operation Nebula Blaze. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 12 | Guilty Roses Patch | Received for repelling the Guilty Roses Squadron. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 13 | Super Battleship Slayer Patch | Received for shooting down the second S battleship. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 14 | TCAF Terra Medal | Received for shielding the fleet and seeing that all ships safely fled the Ingres System. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 15 | Hellfires Patch | Received for repelling the enemy Hellfire Squadron. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 16 | Night Ravens Patch | Received for challenging and eradicating the Night Raven Squadron. | Event | 50 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 17 | Solar System Defense Award | Received for great achievements during the campaign to defend the Solar System. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 18 | Special Operations Medal | Received for heroically destroying the Prometheus Driver. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 19 | 1,000 Units Destroyed Medal | Received for shooting down 1,000 enemy fighters and attackers in combat. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 20 | 10,000 Units Destroyed Medal | Received for shooting down 10,000 enemy fighters and attackers in combat. | Event | 70 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 21 | Ship Hunter Award | Received for shooting down 100 enemy warships in combat. | Event | 50 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 22 | Gigaton Club Patch | Received for shooting down enemy vessels with a total weight of one gigaton. | Event | 70 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 23 | Weapon Lord Patch | Received after you collect all usable equipment for the Delta Saber. | Event | 80 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 24 | TCAF Pilot's Commendation | Commemmorates you as one of the greatest pilots in history. | Event | 100 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +i> 000000E0 +-------------------- PROPERTIES -------------------- ++----------+------------------+-------------+-----------+ +| ID | Name | Matchmaking | Data Size | ++----------+------------------+-------------+-----------+ +| 10000006 | Killed Aircrafts | False | 4 | ++----------+------------------+-------------+-----------+ +| 10000008 | Equipments | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000000A | Clear Time | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000000B | Killed Warships | False | 4 | ++----------+------------------+-------------+-----------+ +| 10008001 | Rank | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000800A | | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000800B | | False | 4 | ++----------+------------------+-------------+-----------+ +| 20000005 | Killed Weight | False | 8 | ++----------+------------------+-------------+-----------+ +| 20000007 | Clear Time | False | 8 | ++----------+------------------+-------------+-----------+ +| 20000009 | Earned Points | False | 8 | ++----------+------------------+-------------+-----------+ +| 40008002 | Gamer Name | False | 2 | ++----------+------------------+-------------+-----------+ +i> 000000E0 +-------------------- CONTEXTS -------------------- ++----------+-------------+-------------+---------------+-----------+ +| ID | Name | Matchmaking | Default Value | Max Value | ++----------+-------------+-------------+---------------+-----------+ +| 00000000 | Game Stage | False | 0 | 28 | ++----------+-------------+-------------+---------------+-----------+ +| 00000001 | Game Status | False | 0 | 9 | ++----------+-------------+-------------+---------------+-----------+ +| 00008001 | | False | 0 | 0 | ++----------+-------------+-------------+---------------+-----------+ +| 0000800A | Game Type | True | 0 | 1 | ++----------+-------------+-------------+---------------+-----------+ +| 0000800B | | True | 0 | 0 | ++----------+-------------+-------------+---------------+-----------+ +i> 000000E0 +-------------------- STATS VIEWS -------------------- ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| ID | View Type | Name | Skilled | Arbitrated | Hidden | Team View | Online Only | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000001 | Leaderboard | Time Attack (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000002 | Leaderboard | Score Attack (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000003 | Leaderboard | Extra 1 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000004 | Leaderboard | Extra 1 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000005 | Leaderboard | Extra 2 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000006 | Leaderboard | Extra 2 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000007 | Leaderboard | Extra 3 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000008 | Leaderboard | Extra 3 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000009 | Leaderboard | Extra 4 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 0000000A | Leaderboard | Extra 4 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 0000000C | Leaderboard | Time Attack (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 0000000D | Leaderboard | Score Attack (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| FFFF0000 | Leaderboard | | True | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +i> 000000E0 +-------------------- PRESENCE MODES -------------------- ++---------------+----------------+------------------+ +| Context Value | Contexts Count | Properties Count | ++---------------+----------------+------------------+ +| 0 | 2 | 0 | ++---------------+----------------+------------------+ +i> 000000E0 XThread01000020 (5) Stack: 70110000-70130000 +i> 000000E0 KernelState: Launching module... +i> 000000E0 XThreadF8000008 (6) Stack: 70150000-701D0000 +K> 01000020 XThread::Execute thid 5 (handle=01000020, 'Kernel Dispatch (01000020)', native=000001A8, ) +K> F8000008 XThread::Execute thid 6 (handle=F8000008, 'Main XThread (F8000008)', native=000001AC) +i> 01000010 Loaded 7 shaders from storage +i> 01000010 Loaded 4 pipeline descriptions, 8 shader translations needed +i> 01000010 Translated 7 shaders in 2 ms +i> 01000010 Pipeline cache loaded: 4 created, 0 already exist, 4 total stored +i> 01000010 Pipeline creation took 0 milliseconds +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800000C type=1 initial_state=0 lr=824A9F6C +F> F8000008 NullDevice::ResolvePath() +F> F8000008 NullDevice::ResolvePath() +F> F8000008 NullDevice::ResolvePath() +!> F8000008 undefined extern call to 8284E0DC IoDismountVolumeByFileHandle +F> F8000008 NullDevice::ResolvePath() +i> F8000008 Got xam task args: v1 = 02080002, v2 = 00000000 +i> F8000008 XThreadF8000010 (7) Stack: 701F0000-70270000 +K> F8000010 XThread::Execute thid 7 (handle=F8000010, 'XThread01D0 (F8000010)', native=000001D0) +F> F8000010 NullDevice::ResolvePath() +w> F8000010 Game is attempting to allocate devkit debug memory (base: 00000000, size: 000FF000). Ignoring debug flag and using normal allocation. +!> F8000010 undefined extern call to 8284DEBC StfsCreateDevice +K> F8000010 AUDIT-HLC KeSetEvent guest_ptr=8287094C lr=824A95D0 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000020 type=1 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000024 (8) Stack: 70290000-702B0000 +K> F8000024 XThread::Execute thid 8 (handle=F8000024, 'XThread01D4 (F8000024)', native=000001D4) +K> F8000024 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000020 alertable=0 lr=824AC578 guest_lr=824AFFC4 +F> F8000008 HostPathDevice::ResolvePath() +i> F8000008 XThreadF800002C (9) Stack: 702D0000-702E0000 +K> F800002C XThread::Execute thid 9 (handle=F800002C, 'XThread01D8 (F800002C)', native=000001D8) +F> F800002C HostPathDevice::ResolvePath() +F> F8000008 HostPathDevice::ResolvePath(\d4ea4615\e\46ee8ca) +F> F800002C HostPathDevice::ResolvePath() +F> F8000008 HostPathDevice::ResolvePath(\d4ea4615\e) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000038 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800003C type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000044 (A) Stack: 70300000-70340000 +K> F8000044 XThread::Execute thid 10 (handle=F8000044, 'XThread01DC (F8000044)', native=000001DC) +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800004C type=0 initial_state=0 lr=824A9F6C +!> F800002C BaseHeap::Release failed because address is not a region start +!> F800002C PhysicalHeap::Release failed due to parent heap failure +F> F800002C HostPathDevice::ResolvePath() +F> F800002C HostPathDevice::ResolvePath() +!> F8000044 BaseHeap::Release failed because address is not a region start +!> F8000044 PhysicalHeap::Release failed due to parent heap failure +K> F8000044 AUDIT-HLC NtSetEvent handle=F8000048 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=82452E64 +!> F800002C BaseHeap::Release failed because address is not a region start +!> F800002C PhysicalHeap::Release failed due to parent heap failure +K> F800002C AUDIT-HLC NtWaitForSingleObjectEx handle=F8000028 alertable=0 lr=824AC578 guest_lr=824AFFC4 +!> F8000008 BaseHeap::Release failed because address is not a region start +!> F8000008 PhysicalHeap::Release failed due to parent heap failure +!> F8000008 BaseHeap::Release failed because address is not a region start +!> F8000008 PhysicalHeap::Release failed due to parent heap failure +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\8\3421153) +F> F8000008 DiscImageDevice::ResolvePath(\dat) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\355f2f8) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000034 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000034 alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000048 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000048 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800004C type=0 initial_state=0 lr=824A9F6C +i> F8000044 XThreadF8000054 (B) Stack: 70360000-70370000 +K> F8000044 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000048 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000054 XThread::Execute thid 11 (handle=F8000054, 'XThread01E0 (F8000054)', native=000001E0) +K> F8000054 AUDIT-HLC NtSetEvent handle=F8000048 lr=824AA304 +K> F8000044 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000048 result=00000000 lr=824AC578 guest_lr=8245148C +!> F8000044 BaseHeap::Release failed because address is not a region start +!> F8000044 PhysicalHeap::Release failed due to parent heap failure +K> F8000044 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000034 result=00000000 lr=824AC578 guest_lr=82452E64 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000034 type=1 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000048 (C) Stack: 70390000-703A0000 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000048 XThread::Execute thid 12 (handle=F8000048, 'XThread01E4 (F8000048)', native=000001E4) +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +i> F8000008 Hardware scaler: width ratio 1:1, height ratio 1:1, final aspect ratio 16:9 +i> 01000010 Selecting rep movs vastcpy. +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800005C type=1 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000060 type=1 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000064 (D) Stack: 703C0000-70440000 +K> F8000064 XThread::Execute thid 13 (handle=F8000064, 'XThread01E8 (F8000064)', native=000001E8) +F> F8000008 HostPathDevice::ResolvePath(\aab216c3\a\2c8c185) +F> F8000008 HostPathDevice::ResolvePath(\aab216c3\a) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800006C type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800006C alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000074 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000074 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000044 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000074 alertable=0 lr=824AC578 guest_lr=8245148C +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000054 AUDIT-HLC NtSetEvent handle=F8000074 lr=824AA304 +K> F8000044 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000074 result=00000000 lr=824AC578 guest_lr=8245148C +!> F8000044 BaseHeap::Release failed because address is not a region start +!> F8000044 PhysicalHeap::Release failed due to parent heap failure +K> F8000044 AUDIT-HLC NtSetEvent handle=F8000070 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800006C result=00000000 lr=824AC578 guest_lr=82452E64 +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\73a5c0a) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800006C type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800006C alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000074 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000074 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000074 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000054 AUDIT-HLC NtSetEvent handle=F8000074 lr=824AA304 +K> F8000044 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000074 result=00000000 lr=824AC578 guest_lr=8245148C +K> F8000044 AUDIT-HLC NtSetEvent handle=F8000070 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800006C result=00000000 lr=824AC578 guest_lr=82452E64 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +i> F8000008 XThreadF800006C (E) Stack: 70460000-704E0000 +i> F8000008 XThreadF8000070 (F) Stack: 70500000-70580000 +K> F800006C XThread::Execute thid 14 (handle=F800006C, 'XThread01EC (F800006C)', native=000001EC) +K> F8000070 XThread::Execute thid 15 (handle=F8000070, 'XThread01F0 (F8000070)', native=000001F0) +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +i> F8000008 AudioSystem::RegisterClient: driver created for index=0, driver=0x7286d7020040 +i> F8000008 AudioSystem::RegisterClient: client 0 registered successfully +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000084 type=0 initial_state=0 lr=824A9F6C +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\39a9dcc) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000084 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +!> F8000044 BaseHeap::Release failed because address is not a region start +!> F8000044 PhysicalHeap::Release failed due to parent heap failure +K> F8000044 AUDIT-HLC NtSetEvent handle=F800008C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000084 result=00000000 lr=824AC578 guest_lr=8245FA10 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000084 type=0 initial_state=0 lr=824A9F6C +F> F8000008 DiscImageDevice::ResolvePath(\dat) +K> F8000008 AUDIT-HLC NtSetEvent handle=F800008C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000084 alertable=0 lr=824AC578 guest_lr=82460150 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000084 result=00000000 lr=824AC578 guest_lr=82460150 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000084 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000084 alertable=0 lr=824AC578 guest_lr=82179148 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtSetEvent handle=F800008C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000084 result=00000000 lr=824AC578 guest_lr=82179148 +i> F8000008 XThreadF8000084 (10) Stack: 705A0000-705B0000 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800008C alertable=0 lr=824AC578 guest_lr=82173BD4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 XThread::Execute thid 16 (handle=F8000084, 'XThread0204 (F8000084)', native=00000204) +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC NtSetEvent handle=F800008C lr=824AA304 +K> F8000064 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000034 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800008C result=00000000 lr=824AC578 guest_lr=82173BD4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000034 lr=824AA304 +K> F8000064 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000034 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000090 (11) Stack: 705D0000-70650000 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000090 alertable=0 lr=824AC578 guest_lr=822F1B50 +K> F8000090 XThread::Execute thid 17 (handle=F8000090, 'XThread0208 (F8000090)', native=00000208) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000090 AUDIT-HLC NtCreateEvent handle=F8000094 type=1 initial_state=1 lr=824A9F6C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000090 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +F> F8000090 HostPathDevice::ResolvePath(\aab216c3\5\ee70e0a) +F> F8000090 HostPathDevice::ResolvePath(\aab216c3\5) +K> F8000090 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000098 alertable=0 lr=824AC578 guest_lr=821CBAE0 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A4 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A4 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A4 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000054 AUDIT-HLC NtSetEvent handle=F80000A4 lr=824AA304 +K> F8000044 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000A4 result=00000000 lr=824AC578 guest_lr=8245148C +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000A0 lr=824AA304 +K> F8000090 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000098 result=00000000 lr=824AC578 guest_lr=821CBAE0 +i> F8000090 XThreadF8000098 (12) Stack: 70670000-70680000 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000098 XThread::Execute thid 18 (handle=F8000098, 'XThread020C (F8000098)', native=0000020C) +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +i> F8000098 XThreadF80000A0 (13) Stack: 706A0000-706D0000 +i> F8000098 XThreadF80000A4 (14) Stack: 706F0000-70720000 +K> F80000A0 XThread::Execute thid 19 (handle=F80000A0, 'XThread0210 (F80000A0)', native=00000210) +K> F80000A4 XThread::Execute thid 20 (handle=F80000A4, 'XThread0214 (F80000A4)', native=00000214) +K> F80000A4 AUDIT-HLC NtWaitForSingleObjectEx handle=F800009C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F800009C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000090 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +F> F8000090 HostPathDevice::ResolvePath(\87719002\c\dba806e) +F> F8000090 HostPathDevice::ResolvePath(\87719002\c) +K> F8000090 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +F> F8000090 HostPathDevice::ResolvePath(\87719002\c\ec0a96e) +F> F8000090 HostPathDevice::ResolvePath(\87719002\c) +F> F8000098 DiscImageDevice::ResolvePath(\hidden\Resource3D) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000C4 type=1 initial_state=0 lr=824A9F6C +K> F8000090 AUDIT-HLC NtCreateEvent handle=F80000C8 type=0 initial_state=0 lr=824A9F6C +F> F8000090 HostPathDevice::ResolvePath(\87719002\a\60fcb85) +F> F8000090 HostPathDevice::ResolvePath(\87719002\a) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000090 AUDIT-HLC NtCreateEvent handle=F80000D4 type=0 initial_state=0 lr=824A9F6C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C4 alertable=0 lr=824AC578 guest_lr=822DFCC8 +F> F8000090 HostPathDevice::ResolvePath(\87719002\2\85d8849) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +F> F8000090 HostPathDevice::ResolvePath(\87719002\2) +K> F8000090 AUDIT-HLC NtCreateEvent handle=F80000E4 type=0 initial_state=0 lr=824A9F6C +F> F8000090 HostPathDevice::ResolvePath(\87719002\a\715f485) +F> F8000090 HostPathDevice::ResolvePath(\87719002\a) +K> F8000090 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +F> F8000090 HostPathDevice::ResolvePath(\87719002\c\f2a8ccd) +F> F8000090 HostPathDevice::ResolvePath(\87719002\c) +K> F8000090 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +F> F8000090 HostPathDevice::ResolvePath(\87719002\0\1a2db9c) +F> F8000090 HostPathDevice::ResolvePath(\87719002\0) +K> F8000090 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C515C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +!> F8000044 BaseHeap::Release failed because address is not a region start +!> F8000044 PhysicalHeap::Release failed due to parent heap failure +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000B0 lr=824AA304 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +!> F8000044 BaseHeap::Release failed because address is not a region start +!> F8000044 PhysicalHeap::Release failed due to parent heap failure +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000BC lr=824AA304 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000D0 lr=824AA304 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C4 result=00000000 lr=824AC578 guest_lr=822DFCC8 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C4 alertable=0 lr=824AC578 guest_lr=822DFE24 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +!> F8000044 BaseHeap::Release failed because address is not a region start +!> F8000044 PhysicalHeap::Release failed due to parent heap failure +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000E0 lr=824AA304 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000EC lr=824AA304 +K> F8000090 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C515C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000F8 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000090 result=00000000 lr=824AC578 guest_lr=822F1B50 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +!> F8000044 BaseHeap::Release failed because address is not a region start +!> F8000044 PhysicalHeap::Release failed due to parent heap failure +K> F8000044 AUDIT-HLC NtSetEvent handle=F8000104 lr=824AA304 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000AC lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C4 result=00000000 lr=824AC578 guest_lr=822DFE24 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C4 alertable=0 lr=824AC578 guest_lr=822DFED0 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF80000B8 (15) Stack: 705D0000-705E0000 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000BC alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F80000B8 XThread::Execute thid 21 (handle=F80000B8, 'XThread0218 (F80000B8)', native=00000218) +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000BC result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000CC type=1 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000AC lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C4 result=00000000 lr=824AC578 guest_lr=822DFED0 +i> F8000008 XThreadF80000AC (16) Stack: 70600000-70610000 +K> F80000AC XThread::Execute thid 22 (handle=F80000AC, 'XThread021C (F80000AC)', native=0000021C) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B0 alertable=0 lr=824AC578 guest_lr=82172BC8 +K> F8000064 AUDIT-HLC NtSetEvent handle=F80000B0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B0 result=00000000 lr=824AC578 guest_lr=82172BC8 +K> F8000064 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000034 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F80000AC AUDIT-HLC NtWaitForSingleObjectEx handle=F80000CC alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +F> F8000098 DiscImageDevice::ResolvePath(\hidden\Resource3D) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000C4 type=1 initial_state=0 lr=824A9F6C +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C4 alertable=0 lr=824AC578 guest_lr=822DFCC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000D0 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C4 result=00000000 lr=824AC578 guest_lr=822DFCC8 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C4 alertable=0 lr=824AC578 guest_lr=822DFE24 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000E8 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF80000E4 (17) Stack: 70630000-70640000 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000E8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000E8 type=0 initial_state=0 lr=824A9F6C +K> F80000E4 XThread::Execute thid 23 (handle=F80000E4, 'XThread0220 (F80000E4)', native=00000220) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000E8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF80000F8 (18) Stack: 70740000-707C0000 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000104 (19) Stack: 707E0000-70860000 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F80000F8 XThread::Execute thid 24 (handle=F80000F8, 'XThread0224 (F80000F8)', native=00000224) +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000104 XThread::Execute thid 25 (handle=F8000104, 'XThread0228 (F8000104)', native=00000228) +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000034 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000064 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000034 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000D0 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C4 result=00000000 lr=824AC578 guest_lr=822DFE24 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C4 alertable=0 lr=824AC578 guest_lr=822DFED0 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A8 alertable=0 lr=824AC578 guest_lr=821CC19C +K> F8000064 AUDIT-HLC NtSetEvent handle=F80000A8 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000A8 result=00000000 lr=824AC578 guest_lr=821CC19C +K> F8000064 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000034 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000D0 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C4 result=00000000 lr=824AC578 guest_lr=822DFED0 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +F> F8000098 DiscImageDevice::ResolvePath(\hidden\Resource3D) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000C0 type=1 initial_state=0 lr=824A9F6C +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=822DFCC8 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000C4 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=822DFCC8 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=822DFE24 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000C4 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=822DFE24 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=822DFED0 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000D0 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000C4 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=822DFED0 +F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\f\ca5c62e) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\d\14ba3f8) +F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\d) +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A8 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +!> F8000044 BaseHeap::Release failed because address is not a region start +!> F8000044 PhysicalHeap::Release failed due to parent heap failure +!> F8000044 BaseHeap::Release failed because address is not a region start +!> F8000044 PhysicalHeap::Release failed due to parent heap failure +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000C4 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000A8 result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\8\14c242d) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\5\6324af0) +F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\5) +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A8 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000C4 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000A8 result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\d\70a9531) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\a\c9606f9) +F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\a) +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A8 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000C4 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000A8 result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\7\9f2d535) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\4\efaecd1) +F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\4) +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A8 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000C4 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000A8 result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\7\0c3bba2) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\4\59fbfe8) +F> F8000098 HostPathDevice::ResolvePath(\69d8e45c\4) +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A8 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtSetEvent handle=F80000C4 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000A8 result=00000000 lr=824AC578 guest_lr=8245FA10 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000034 lr=824AA304 +K> F8000064 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000034 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000094 alertable=0 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000094 result=00000000 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000094 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B4 alertable=0 lr=824AC578 guest_lr=821CC19C +K> F8000064 AUDIT-HLC NtSetEvent handle=F80000B4 lr=824AA304 +K> F8000064 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000034 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B4 result=00000000 lr=824AC578 guest_lr=821CC19C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000034 lr=824AA304 +K> F8000064 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000034 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000094 alertable=0 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000094 result=00000000 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000094 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF80000D0 (1A) Stack: 70880000-70900000 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F80000D0 XThread::Execute thid 26 (handle=F80000D0, 'XThread022C (F80000D0)', native=0000022C) +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F80000D0 AUDIT-HLC NtCreateEvent handle=F800010C type=1 initial_state=1 lr=824A9F6C +K> F80000D0 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +F> F80000D0 HostPathDevice::ResolvePath(\aab216c3\5\c10eae6) +F> F80000D0 HostPathDevice::ResolvePath(\aab216c3\5) +K> F80000D0 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000110 alertable=0 lr=824AC578 guest_lr=821CBAE0 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800011C type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F800011C type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtWaitForSingleObjectEx handle=F800011C alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000054 AUDIT-HLC NtSetEvent handle=F800011C lr=824AA304 +K> F8000044 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800011C result=00000000 lr=824AC578 guest_lr=8245148C +K> F8000044 AUDIT-HLC NtSetEvent handle=F8000118 lr=824AA304 +K> F80000D0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000110 result=00000000 lr=824AC578 guest_lr=821CBAE0 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000084 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +F> F8000084 DiscImageDevice::ResolvePath(\dat) +K> F8000084 AUDIT-HLC NtSetEvent handle=F800011C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000114 alertable=0 lr=824AC578 guest_lr=82460150 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000114 result=00000000 lr=824AC578 guest_lr=82460150 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000044 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C4 alertable=0 lr=824AC578 guest_lr=82172BC8 +K> F8000064 AUDIT-HLC NtSetEvent handle=F80000C4 lr=824AA304 +K> F8000064 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000034 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C4 result=00000000 lr=824AC578 guest_lr=82172BC8 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +F> F8000008 DiscImageDevice::ResolvePath(\dat\movie) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800011C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000120 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000124 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000128 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800012C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000130 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000134 type=0 initial_state=1 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +F> F8000008 DiscImageDevice::ResolvePath(\dat\movie) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800013C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000140 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000144 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000148 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800014C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000150 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000154 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000158 type=0 initial_state=1 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +i> F8000008 XThreadF800015C (1B) Stack: 70880000-70890000 +i> F8000008 XThreadF8000160 (1C) Stack: 708B0000-708C0000 +i> F8000008 XThreadF8000164 (1D) Stack: 708E0000-708F0000 +i> F8000008 XThreadF8000168 (1E) Stack: 70910000-70920000 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000034 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000064 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000034 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25284 lr=82507ABC +K> F8000064 AUDIT-HLC silph_ctx_dump ctx_base=BCE251C0 (event BCE25284 at +C4) +K> F8000064 AUDIT-HLC DUMP BCE251C0: 8200A1E8 BCE251C0 BCE251C0 00000001 +K> F8000064 AUDIT-HLC DUMP BCE251D0: 01000000 00000000 3F7FCCCC 3F802D83 +K> F8000064 AUDIT-HLC DUMP BCE251E0: 00000000 00000001 30057018 BCE25640 +K> F8000064 AUDIT-HLC DUMP BCE251F0: BE568F00 00000000 00000000 00000000 +K> F8000064 AUDIT-HLC DUMP BCE25200: 00000000 00000000 00000000 00000000 +K> F8000064 AUDIT-HLC DUMP BCE25210: 00000000 01000000 00000000 BCE2521C +K> F8000064 AUDIT-HLC DUMP BCE25220: BCE2521C 01000000 00000000 BCE2522C +K> F8000064 AUDIT-HLC DUMP BCE25230: BCE2522C 01000000 00000000 BCE2523C +K> F8000064 AUDIT-HLC DUMP BCE25240: BCE2523C 01000000 00000000 BCE2524C +K> F8000064 AUDIT-HLC DUMP BCE25250: BCE2524C 00000000 00000001 58454E00 +K> F8000064 AUDIT-HLC DUMP BCE25260: F800016C 00000000 00000001 58454E00 +K> F8000064 AUDIT-HLC DUMP BCE25270: F8000170 00000000 00000001 58454E00 +K> F8000064 AUDIT-HLC DUMP BCE25280: F8000174 00000000 00000001 58454E00 +K> F8000064 AUDIT-HLC DUMP BCE25290: F8000178 00000001 00000001 00000005 +K> F8000064 AUDIT-HLC DUMP BCE252A0: 00000000 00000000 00000500 000002D0 +K> F8000064 AUDIT-HLC DUMP BCE252B0: 00000001 00000000 00000000 00000000 +K> F8000064 AUDIT-HLC DUMP BCE252C0: 00000000 00000000 F800015C F8000160 +K> F8000064 AUDIT-HLC DUMP BCE252D0: F8000164 F8000168 3F800000 00000000 +K> F8000064 AUDIT-HLC DUMP BCE252E0: 00000000 00000000 C9D4E2F1 00458000 +K> F8000064 AUDIT-HLC DUMP BCE252F0: 00053C96 E1B10217 00273000 0000D852 +K> F8000064 AUDIT-HLC DUMP BCE25300: EF97D70C 00533800 0000C068 FC2B1076 +K> F8000064 AUDIT-HLC DUMP BCE25310: 00228800 00000096 00000000 00000000 +K> F8000064 AUDIT-HLC DUMP BCE25320: 00000000 00000000 00000000 00000000 +K> F8000064 AUDIT-HLC DUMP BCE25330: 00000000 00000000 00000000 00000000 +K> F8000064 AUDIT-HLC DUMP BCE25340: 07C65ADA 001EE000 0003A313 0A16C32D +K> F8000064 AUDIT-HLC DUMP BCE25350: 004E6800 00000096 15B20D91 004AC000 +K> F8000064 AUDIT-HLC DUMP BCE25360: 0003A313 28824F7D 002A0000 0001A7B3 +K> F8000064 AUDIT-HLC DUMP BCE25370: 340AB384 00281000 0001EED7 366E0234 +K> F8000064 AUDIT-HLC DUMP BCE25380: 00562800 0001B751 389766D3 00255800 +K> F8000064 AUDIT-HLC DUMP BCE25390: 0000D21B 399D8FD3 00263000 0000FAA7 +K> F8000064 AUDIT-HLC DUMP BCE253A0: 42589090 00540000 000220D3 46844E1D +K> F8000064 AUDIT-HLC DUMP BCE253B0: 00516000 0000D8F5 478A771D 00524000 +K> F8000064 AUDIT-HLC DUMP BCE253C0: 0000F3F8 4EF1DADB 0017E000 000064BD +K> F8000064 AUDIT-HLC DUMP BCE253D0: 53D66292 00000000 0017D9C4 5C3FBE10 +K> F8000064 AUDIT-HLC DUMP BCE253E0: 00438800 0000778E 6110543D 002BA800 +K> F8000064 AUDIT-HLC DUMP BCE253F0: 0017D9C4 8E32D0DC 00251800 00003E12 +K> F8000064 AUDIT-HLC DUMP BCE25400: 99D964C8 00184800 00017C57 9CE5067F +K> F8000064 AUDIT-HLC DUMP BCE25410: 00511000 00004AE7 A7B85146 00440000 +K> F8000064 AUDIT-HLC DUMP BCE25420: 0001790C B408C4D3 00229000 000282BA +K> F8000064 AUDIT-HLC DUMP BCE25430: BBF5F673 0019C800 0005116C C2E7AB28 +K> F8000064 AUDIT-HLC DUMP BCE25440: 004E7000 00029B67 C9D4E2F1 00458000 +K> F8000064 AUDIT-HLC DUMP BCE25450: 00053C96 E1B10217 00273000 0000D852 +K> F8000064 AUDIT-HLC DUMP BCE25460: EF97D70C 00533800 0000C068 FC2B1076 +K> F8000064 AUDIT-HLC DUMP BCE25470: 00228800 00000096 00000000 00000000 +K> F8000064 AUDIT-HLC DUMP BCE25480: 00000000 00000000 00000000 00000000 +K> F8000064 AUDIT-HLC DUMP BCE25490: 00000000 00000000 00000000 00000000 +K> F8000064 AUDIT-HLC DUMP BCE254A0: 00000000 00000000 00000000 00000000 +K> F8000064 AUDIT-HLC DUMP BCE254B0: 00000000 00000000 00000000 00000000 +K> F8000064 AUDIT-HLC silph_ctx event-slots: +K> F8000064 AUDIT-HLC slot[0] off=+54 addr=BCE25214 hdr=01000000 state=00000000 +K> F8000064 AUDIT-HLC slot[1] off=+64 addr=BCE25224 hdr=01000000 state=00000000 +K> F8000064 AUDIT-HLC slot[2] off=+74 addr=BCE25234 hdr=01000000 state=00000000 +K> F8000064 AUDIT-HLC slot[3] off=+84 addr=BCE25244 hdr=01000000 state=00000000 +K> F8000064 AUDIT-HLC slot[4] off=+94 addr=BCE25254 hdr=00000000 state=00000001 +K> F8000064 AUDIT-HLC slot[5] off=+A4 addr=BCE25264 hdr=00000000 state=00000001 +K> F8000064 AUDIT-HLC slot[6] off=+B4 addr=BCE25274 hdr=00000000 state=00000001 +K> F8000064 AUDIT-HLC slot[7] off=+C4 addr=BCE25284 hdr=00000000 state=00000001 +K> F800015C XThread::Execute thid 27 (handle=F800015C, 'XThread0230 (F800015C)', native=00000230) +K> F8000160 XThread::Execute thid 28 (handle=F8000160, 'XThread0234 (F8000160)', native=00000234) +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000164 XThread::Execute thid 29 (handle=F8000164, 'XThread0238 (F8000164)', native=00000238) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000160 AUDIT-HLC KeSetEvent guest_ptr=BCE25244 lr=82506F9C +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F800005C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800005C result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800005C alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000084 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000064 AUDIT-HLC KeSetEvent guest_ptr=BCE25224 lr=82508358 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25214 lr=82508510 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82508524 +K> F800006C AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE25234 lr=82506C90 diff --git a/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.stdout.run2 b/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.stdout.run2 new file mode 100644 index 0000000..27ce8d9 --- /dev/null +++ b/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.stdout.run2 @@ -0,0 +1,36380 @@ +i> 000000D4 Build: canary_experimental@99fd19d02 on Jun 5 2026 +i> 000000D4 Storage root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug +i> 000000D4 ----------- CONFIG DUMP ----------- + +[APU] +apu = "any" +apu_max_queued_frames = 8 +enable_xmp = true +ffmpeg_verbose = false +mute = false +use_dedicated_xma_thread = true +xma_decoder = "new" + +[Auditing] +audit_handle_lifecycle = false +audit_jit_prolog_pc = 0 + +[CPU] +break_condition_gpr = -1 +break_condition_op = "eq" +break_condition_truncate = true +break_condition_value = 0 +break_on_debugbreak = true +break_on_instruction = 0 +break_on_start = false +break_on_unimplemented_instructions = true +clock_no_scaling = false +clock_source_raw = false +cpu = "any" +debug_symbol_loader = false +debugprint_trap_log = false +disable_context_promotion = false +disable_instruction_infocache = false +disable_prefetch_and_cachecontrol = true +disassemble_functions = false +dump_translated_hir_functions = false +elide_e0_check = false +emit_inline_mmio_checks = false +emit_mmio_aware_stores_for_recorded_exception_addresses = true +emit_source_annotations = false +enable_early_precompilation = false +full_optimization_even_with_debug = false +ignore_trap_instructions = true +ignore_undefined_externs = true +inline_loadclock = false +inline_mmio_access = true +load_module_map = "" +no_reserved_ops = false +no_round_to_single = false +permit_float_constant_evaluation = false +pvr = 7407360 +record_mmio_access_exceptions = true +store_all_context_values = false +trace_function_coverage = false +trace_function_data = false +trace_function_data_path = "" +trace_function_references = false +trace_functions = false +use_fast_dot_product = false +validate_hir = false +writable_code_segments = false + +[Config] +defaults_date = 2026040912 + +[Content] +license_mask = 0 + +[D3D12] +d3d12_adapter = -1 +d3d12_allow_variable_refresh_rate_and_tearing = true +d3d12_bindless = true +d3d12_break_on_error = false +d3d12_break_on_warning = false +d3d12_debug = false +d3d12_dxbc_disasm = false +d3d12_dxbc_disasm_dxilconv = false +d3d12_pipeline_creation_threads = -1 +d3d12_queue_priority = 1 +d3d12_submit_on_primary_buffer_end = true +d3d12_tessellation_wireframe = false + +[Display] +fullscreen = false +host_present_from_non_ui_thread = true +postprocess_antialiasing = "" +postprocess_dither = true +postprocess_ffx_cas_additional_sharpness = 0 +postprocess_ffx_fsr_max_upsampling_passes = 4 +postprocess_ffx_fsr_sharpness_reduction = 0.20000000298023224 +postprocess_scaling_and_sharpening = "" +present_letterbox = true +present_render_pass_clear = true +present_safe_area_x = 100 +present_safe_area_y = 100 + +[GPU] +anisotropic_override = -1 +async_shader_compilation = true +clear_memory_page_state = false +depth_float24_convert_in_pixel_shader = false +depth_float24_round = false +depth_transfer_not_equal_test = true +disassemble_pm4 = false +draw_resolution_scale_x = 1 +draw_resolution_scale_y = 1 +draw_resolution_scaled_texture_offsets = true +dump_shaders = "" +dxbc_source_map = false +dxbc_switch = true +execute_unclipped_draw_vs_on_cpu = true +execute_unclipped_draw_vs_on_cpu_for_psi_render_backend = true +execute_unclipped_draw_vs_on_cpu_with_scissor = false +force_convert_line_loops_to_strips = false +force_convert_quad_lists_to_triangle_lists = false +force_convert_triangle_fans_to_lists = false +framerate_limit = 0 +gamma_render_target_as_unorm16 = true +gpu = "any" +gpu_3d_to_2d_texture = true +gpu_allow_invalid_fetch_constants = true +gpu_allow_invalid_upload_range = false +half_pixel_offset = true +ignore_32bit_vertex_index_support = false +log_guest_driven_gpu_register_written_values = false +log_ringbuffer_kickoff_initiator_bts = false +mrt_edram_used_range_clamp_to_min = true +native_2x_msaa = true +native_stencil_value_output = true +native_stencil_value_output_d3d12_intel = false +no_discard_stencil_in_transfer_pipelines = false +non_seamless_cube_map = true +occlusion_query = "fast" +occlusion_query_fake_lower_threshold = 80 +occlusion_query_fake_upper_threshold = 100 +occlusion_query_querybatch_range = 0 +occlusion_query_saturation = 1 +primitive_processor_cache_min_indices = 4096 +readback_memexport = false +readback_resolve = "none" +render_target_path_d3d12 = "" +render_target_path_vulkan = "" +resolve_resolution_scale_fill_half_pixel_offset = true +snorm16_render_target_full_range = true +store_shaders = true +target_trace_file = "" +texture_cache_memory_limit_hard = 768 +texture_cache_memory_limit_render_to_texture = 24 +texture_cache_memory_limit_soft = 384 +texture_cache_memory_limit_soft_lifetime = 30 +tiled_shared_memory = true +trace_dump_path = "" +trace_gpu_prefix = "scratch/gpu/" +trace_gpu_stream = false +use_fuzzy_alpha_epsilon = false +vsync = true + +[General] +allow_game_relative_writes = false +allow_plugins = false +apply_patches = true +controller_hotkeys = false +debug = false +disable_doubleclick_fullscreen = false +discord = true +launch_module = "" +notification_sound_path = "" +priority_class = 0 +recent_titles_entry_amount = 10 +time_scalar = 1 + +[HACKS] +ac6_ground_fix = false + +[HID] +guide_button = true +hid = "any" +keyboard_mode = 0 +keyboard_user_index = 0 +left_stick_deadzone_percentage = 0 +right_stick_deadzone_percentage = 0 +vibration = true + +[HID.WinKey] +keybind_a = "0xBA" +keybind_b = "0xDE" +keybind_back = "Z" +keybind_dpad_down = "^S" +keybind_dpad_left = "^A" +keybind_dpad_right = "^D" +keybind_dpad_up = "^W" +keybind_guide = "0x08" +keybind_left_shoulder = "1" +keybind_left_thumb = "F" +keybind_left_thumb_down = "_S" +keybind_left_thumb_left = "_A" +keybind_left_thumb_right = "_D" +keybind_left_thumb_up = "_W" +keybind_left_trigger = "Q I" +keybind_right_shoulder = "3" +keybind_right_thumb = "K" +keybind_right_thumb_down = "0x28" +keybind_right_thumb_left = "0x25" +keybind_right_thumb_right = "0x27" +keybind_right_thumb_up = "0x26" +keybind_right_trigger = "E O" +keybind_start = "X" +keybind_x = "L" +keybind_y = "P" + +[Kernel] +allow_avatar_initialization = false +allow_incompatible_title_update = true +apply_title_update = true +cl = "" +console_type = 0 +default_achievements_backend = "GPD" +ignore_thread_affinities = true +ignore_thread_priorities = false +kernel_build_version = 1888 +kernel_cert_monitor = false +kernel_debug_monitor = false +kernel_display_gamma_power = 2.22222233 +kernel_display_gamma_type = 2 +kernel_pix = false +staging_mode = false + +[Logging] +enable_console = false +flush_log = true +log_file = "" +log_high_frequency_kernel_calls = false +log_level = 2 +log_mask = 0 +log_string_format_kernel_calls = false +log_to_debugprint = false +log_to_stdout = true + +[Memory] +ignore_offset_for_ranged_allocations = false +protect_on_release = false +protect_zero = true +scribble_heap = false +scribble_heap_value = 0 +writable_executable_memory = true + +[Profiles] +logged_profile_slot_0_xuid = "" +logged_profile_slot_1_xuid = "" +logged_profile_slot_2_xuid = "" +logged_profile_slot_3_xuid = "" + +[SDL] +mappings_file = "gamecontrollerdb.txt" + +[Storage] +cache_root = "" +content_root = "" +force_mount_devkit = false +mount_cache = true +mount_memory_unit = false +mount_scratch = false +storage_root = "" + +[UI] +custom_font_path = "" +font_size = 14 +headless = false +imgui_debug = false +profiler_dpi_scaling = false +show_achievement_notification = false +show_profiler = false +storage_selection_dialog = false +window_size_x = 1280 +window_size_y = 720 + +[Video] +avpack = 8 +custom_internal_display_resolution_x = 0 +custom_internal_display_resolution_y = 0 +enable_3d_mode = false +interlaced = false + +[Vulkan] +vulkan_allow_present_mode_fifo_relaxed = true +vulkan_allow_present_mode_immediate = true +vulkan_allow_present_mode_mailbox = true +vulkan_device = -1 +vulkan_log_debug_messages = true +vulkan_pipeline_creation_threads = -1 +vulkan_semaphore_reuse_workaround = false +vulkan_sparse_shared_memory = true +vulkan_validation = false + +[Win32] +win32_high_resolution_timer = true +win32_mmcss = true + +[x64] +align_all_basic_blocks = 0 +delay_via_maybeyield = false +enable_host_guest_stack_synchronization = true +enable_incorrect_roundingmode_behavior = false +enable_rmw_context_merging = false +instrument_call_times = false +max_stackpoints = 65536 +x64_extension_mask = -1 +xop_arithmetic_right_shifts = false +xop_compares = true +xop_left_shifts = false +xop_right_shifts = false +xop_rotates = false +----------- END OF CONFIG DUMP ---- +i> 000000D4 Loaded config: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\xenia-canary.config.toml +i> 000000D4 Content root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\content +i> 000000D4 Host cache root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\cache_host +w> 000000D4 Unable to load Japanese font; JP characters will be boxes +w> 000000D4 Unable to load Japanese font; JP characters will be boxes +i> 00000124 Setup: Initializing Memory... +i> 00000124 Setup: Initializing Exports... +i> 00000124 Setup: Initializing Processor... +i> 00000124 Setup: Initializing Audio... +i> 00000124 Setup: Initializing Graphics... +i> 00000124 Setup: Initializing HID... +i> 00000124 winkey: "0x08" binds key 0x8 to controller input GUIDE. +i> 00000124 winkey: "^A" binds key 0x41 to controller input DPAD_LEFT. +i> 00000124 winkey: "^D" binds key 0x44 to controller input DPAD_RIGHT. +i> 00000124 winkey: "^S" binds key 0x53 to controller input DPAD_DOWN. +i> 00000124 winkey: "^W" binds key 0x57 to controller input DPAD_UP. +i> 00000124 winkey: "_A" binds key 0x41 to controller input LEFT_THUMB_LEFT. +i> 00000124 winkey: "_D" binds key 0x44 to controller input LEFT_THUMB_RIGHT. +i> 00000124 winkey: "_S" binds key 0x53 to controller input LEFT_THUMB_DOWN. +i> 00000124 winkey: "_W" binds key 0x57 to controller input LEFT_THUMB_UP. +i> 00000124 winkey: "F" binds key 0x46 to controller input LEFT_THUMB_PRESSED. +i> 00000124 winkey: "0x26" binds key 0x26 to controller input RIGHT_THUMB_UP. +i> 00000124 winkey: "0x28" binds key 0x28 to controller input RIGHT_THUMB_DOWN. +i> 00000124 winkey: "0x27" binds key 0x27 to controller input RIGHT_THUMB_RIGHT. +i> 00000124 winkey: "0x25" binds key 0x25 to controller input RIGHT_THUMB_LEFT. +i> 00000124 winkey: "K" binds key 0x4B to controller input RIGHT_THUMB_PRESSED. +i> 00000124 winkey: "L" binds key 0x4C to controller input X. +i> 00000124 winkey: "0xDE" binds key 0xDE to controller input B. +i> 00000124 winkey: "0xBA" binds key 0xBA to controller input A. +i> 00000124 winkey: "P" binds key 0x50 to controller input Y. +i> 00000124 winkey: "Q" binds key 0x51 to controller input LEFT_TRIGGER. +i> 00000124 winkey: "I" binds key 0x49 to controller input LEFT_TRIGGER. +i> 00000124 winkey: "E" binds key 0x45 to controller input RIGHT_TRIGGER. +i> 00000124 winkey: "O" binds key 0x4F to controller input RIGHT_TRIGGER. +i> 00000124 winkey: "Z" binds key 0x5A to controller input BACK. +i> 00000124 winkey: "X" binds key 0x58 to controller input START. +i> 00000124 winkey: "1" binds key 0x31 to controller input LEFT_SHOULDER. +i> 00000124 winkey: "3" binds key 0x33 to controller input RIGHT_SHOULDER. +i> 000000D4 SDL Version 2.32.2 initialized. +w> 000000D4 SDL GameControllerDB: file 'gamecontrollerdb.txt' does not exist. +i> 00000124 Setup: Initializing VFS... +i> 00000124 PatchDB: Loaded patches for 0 titles +i> 00000124 Setup: Initializing Kernel... +i> 00000124 ProfileManager: Found 0 Profiles +w> 00000124 BaseHeap::AllocFixed attempting commit on unreserved page +w> 00000124 BaseHeap::AllocFixed attempting commit on unreserved page +i> 00000124 Setup: Starting graphics_system... +i> 00000124 DXGI adapter: NVIDIA GeForce GTX 1070 Ti (vendor 0x1002, device 0x73DF) +i> 00000124 Direct3D 12 device and OS features: +* Max GPU virtual address bits per resource: 40 +* Non-zeroed heap creation: yes +* Pixel-shader-specified stencil reference: no +* Programmable sample positions: tier 0 +* Rasterizer-ordered views: yes +* Resource binding: tier 3 +* Tiled resources: tier 4 +* Unaligned block-compressed textures: yes +i> 00000124 XThread01000010 (1) Stack: 70010000-70030000 +i> 00000124 XThread01000014 (2) Stack: 70050000-70070000 +i> 00000124 Setup: Starting audio_system... +K> 01000010 XThread::Execute thid 1 (handle=01000010, 'GPU Commands (01000010)', native=00000154, ) +K> 01000014 XThread::Execute thid 2 (handle=01000014, 'GPU Frame limiter (01000014)', native=00000158, ) +i> 00000124 XThread01000018 (3) Stack: 70090000-700B0000 +i> 00000124 XThread0100001C (4) Stack: 700D0000-700F0000 +K> 01000018 XThread::Execute thid 3 (handle=01000018, 'XMA Decoder (01000018)', native=00000180, ) +K> 0100001C XThread::Execute thid 4 (handle=0100001C, 'Audio Worker (0100001C)', native=00000184, ) +i> 000000D4 Checking for XISO +F> 000000D4 DiscImageDevice::Initialize +i> 000000D4 Checking for XISO +F> 000000D4 DiscImageDevice::Initialize +F> 000000D4 DiscImageDevice::Initialize +i> 000000D4 Loading module GAME:\default.xex +F> 000000D4 DiscImageDevice::ResolvePath(\default.xex) +i> 000000D4 Module \Device\Cdrom0\default.xex: +Module Hash: CCF935D24A74E002 + Module Flags: 00000001 + XEX_MODULE_TITLE +Security Header: + Image Flags: 00000008 + XEX_IMAGE_XGD2_MEDIA_ONLY + Load Address: 82000000 + Image Size: 00920000 + Export Table: 00000000 +Optional Header Count: 15 + XEX_HEADER_RESOURCE_INFO: + 535107D4 828FB900-8291D8CF, 139215b + XEX_HEADER_FILE_FORMAT_INFO: + Info Size: 36 + Encryption Type: Normal + Compression Type: Normal + Window Size: 32768 + Block Size: 61440 + Block Hash: B3 2B D7 D4 EF 96 9A C5 9F D7 77 C6 8A 99 AA 1C BD 87 1C BE 00 90 2E F1 46 3F A3 D7 00 00 00 10 + XEX_HEADER_ENTRY_POINT: 824AB748 + XEX_HEADER_IMAGE_BASE_ADDRESS: 82000000 + XEX_HEADER_IMPORT_LIBRARIES: + xam.xex - 104 imports + Version: 2.0.4552.0 + Min Version: 2.0.4552.0 + xboxkrnl.exe - 294 imports + Version: 2.0.4552.0 + Min Version: 2.0.4552.0 + XEX_HEADER_CHECKSUM_TIMESTAMP: + Checksum : 00902EF1 + Time Stamp: 463FA3D7 - Tue May 8 00:10:31 2007 + XEX_HEADER_ORIGINAL_PE_NAME: default.pe + XEX_HEADER_STATIC_LIBRARIES: + XAPILIB : 2.0.3215.0 + D3D9 : 2.0.3215.1 + D3DX9 : 2.0.3215.0 + XBOXKRNL : 2.0.3215.0 + XAUD : 2.0.3215.0 + LIBCPMT : 2.0.3215.0 + XMP : 2.0.3215.0 + XMEDIA : 2.0.3215.0 + XONLINE : 2.0.3215.0 + XGRAPHC : 2.0.3215.0 + X3DAUD : 2.0.3215.1 + XACT : 2.0.3215.1 + XEX_HEADER_TLS_INFO: + Slot Count: 64 + Raw Data Address: 00000000 + Data Size: 0 + Raw Data Size: 0 + XEX_HEADER_DEFAULT_STACK_SIZE: 524288 + XEX_HEADER_SYSTEM_FLAGS: 00000400 + XEX_SYSTEM_PAL50_INCOMPATIBLE + XEX_HEADER_EXECUTION_INFO: + Media ID: 2D2E2EEB + Title ID: 535107D4 + Savegame ID: 535107D4 + Disc Number / Total: 1 / 1 + XEX_HEADER_GAME_RATINGS: + ESRB: Teen + PEGI: 12+ + PEGI-FI: 11+ + PEGI - PT: 12+ + BBFC: 12+ + CERO: Unrated + USK: Approved for children aged 12 and above + OFLC - AU: Parental Guidance + OFLC - NZ: Parental Guidance + KMRB: Unrated + Brazil: Unrated + FPB: 13+ + XEX_HEADER_LAN_KEY: E0 3C EA 47 3C AE 06 62 98 8F DB 7F 58 50 12 38 + XEX_HEADER_XBOX360_LOGO: + Section Size: 1736 + Logo Size: 1728 +Sections: + 0 RODATA 1 pages 82000000 - 82010000 (65536 bytes) + 1 RODATA 1 pages 82010000 - 82020000 (65536 bytes) + 2 RODATA 1 pages 82020000 - 82030000 (65536 bytes) + 3 RODATA 1 pages 82030000 - 82040000 (65536 bytes) + 4 RODATA 1 pages 82040000 - 82050000 (65536 bytes) + 5 RODATA 1 pages 82050000 - 82060000 (65536 bytes) + 6 RODATA 1 pages 82060000 - 82070000 (65536 bytes) + 7 RODATA 1 pages 82070000 - 82080000 (65536 bytes) + 8 RODATA 1 pages 82080000 - 82090000 (65536 bytes) + 9 RODATA 1 pages 82090000 - 820A0000 (65536 bytes) + 10 RODATA 1 pages 820A0000 - 820B0000 (65536 bytes) + 11 RODATA 1 pages 820B0000 - 820C0000 (65536 bytes) + 12 RODATA 1 pages 820C0000 - 820D0000 (65536 bytes) + 13 RODATA 1 pages 820D0000 - 820E0000 (65536 bytes) + 14 RODATA 1 pages 820E0000 - 820F0000 (65536 bytes) + 15 RODATA 1 pages 820F0000 - 82100000 (65536 bytes) + 16 RODATA 1 pages 82100000 - 82110000 (65536 bytes) + 17 RODATA 1 pages 82110000 - 82120000 (65536 bytes) + 18 RODATA 1 pages 82120000 - 82130000 (65536 bytes) + 19 RODATA 1 pages 82130000 - 82140000 (65536 bytes) + 20 RODATA 1 pages 82140000 - 82150000 (65536 bytes) + 21 CODE 1 pages 82150000 - 82160000 (65536 bytes) + 22 CODE 1 pages 82160000 - 82170000 (65536 bytes) + 23 CODE 1 pages 82170000 - 82180000 (65536 bytes) + 24 CODE 1 pages 82180000 - 82190000 (65536 bytes) + 25 CODE 1 pages 82190000 - 821A0000 (65536 bytes) + 26 CODE 1 pages 821A0000 - 821B0000 (65536 bytes) + 27 CODE 1 pages 821B0000 - 821C0000 (65536 bytes) + 28 CODE 1 pages 821C0000 - 821D0000 (65536 bytes) + 29 CODE 1 pages 821D0000 - 821E0000 (65536 bytes) + 30 CODE 1 pages 821E0000 - 821F0000 (65536 bytes) + 31 CODE 1 pages 821F0000 - 82200000 (65536 bytes) + 32 CODE 1 pages 82200000 - 82210000 (65536 bytes) + 33 CODE 1 pages 82210000 - 82220000 (65536 bytes) + 34 CODE 1 pages 82220000 - 82230000 (65536 bytes) + 35 CODE 1 pages 82230000 - 82240000 (65536 bytes) + 36 CODE 1 pages 82240000 - 82250000 (65536 bytes) + 37 CODE 1 pages 82250000 - 82260000 (65536 bytes) + 38 CODE 1 pages 82260000 - 82270000 (65536 bytes) + 39 CODE 1 pages 82270000 - 82280000 (65536 bytes) + 40 CODE 1 pages 82280000 - 82290000 (65536 bytes) + 41 CODE 1 pages 82290000 - 822A0000 (65536 bytes) + 42 CODE 1 pages 822A0000 - 822B0000 (65536 bytes) + 43 CODE 1 pages 822B0000 - 822C0000 (65536 bytes) + 44 CODE 1 pages 822C0000 - 822D0000 (65536 bytes) + 45 CODE 1 pages 822D0000 - 822E0000 (65536 bytes) + 46 CODE 1 pages 822E0000 - 822F0000 (65536 bytes) + 47 CODE 1 pages 822F0000 - 82300000 (65536 bytes) + 48 CODE 1 pages 82300000 - 82310000 (65536 bytes) + 49 CODE 1 pages 82310000 - 82320000 (65536 bytes) + 50 CODE 1 pages 82320000 - 82330000 (65536 bytes) + 51 CODE 1 pages 82330000 - 82340000 (65536 bytes) + 52 CODE 1 pages 82340000 - 82350000 (65536 bytes) + 53 CODE 1 pages 82350000 - 82360000 (65536 bytes) + 54 CODE 1 pages 82360000 - 82370000 (65536 bytes) + 55 CODE 1 pages 82370000 - 82380000 (65536 bytes) + 56 CODE 1 pages 82380000 - 82390000 (65536 bytes) + 57 CODE 1 pages 82390000 - 823A0000 (65536 bytes) + 58 CODE 1 pages 823A0000 - 823B0000 (65536 bytes) + 59 CODE 1 pages 823B0000 - 823C0000 (65536 bytes) + 60 CODE 1 pages 823C0000 - 823D0000 (65536 bytes) + 61 CODE 1 pages 823D0000 - 823E0000 (65536 bytes) + 62 CODE 1 pages 823E0000 - 823F0000 (65536 bytes) + 63 CODE 1 pages 823F0000 - 82400000 (65536 bytes) + 64 CODE 1 pages 82400000 - 82410000 (65536 bytes) + 65 CODE 1 pages 82410000 - 82420000 (65536 bytes) + 66 CODE 1 pages 82420000 - 82430000 (65536 bytes) + 67 CODE 1 pages 82430000 - 82440000 (65536 bytes) + 68 CODE 1 pages 82440000 - 82450000 (65536 bytes) + 69 CODE 1 pages 82450000 - 82460000 (65536 bytes) + 70 CODE 1 pages 82460000 - 82470000 (65536 bytes) + 71 CODE 1 pages 82470000 - 82480000 (65536 bytes) + 72 CODE 1 pages 82480000 - 82490000 (65536 bytes) + 73 CODE 1 pages 82490000 - 824A0000 (65536 bytes) + 74 CODE 1 pages 824A0000 - 824B0000 (65536 bytes) + 75 CODE 1 pages 824B0000 - 824C0000 (65536 bytes) + 76 CODE 1 pages 824C0000 - 824D0000 (65536 bytes) + 77 CODE 1 pages 824D0000 - 824E0000 (65536 bytes) + 78 CODE 1 pages 824E0000 - 824F0000 (65536 bytes) + 79 CODE 1 pages 824F0000 - 82500000 (65536 bytes) + 80 CODE 1 pages 82500000 - 82510000 (65536 bytes) + 81 CODE 1 pages 82510000 - 82520000 (65536 bytes) + 82 CODE 1 pages 82520000 - 82530000 (65536 bytes) + 83 CODE 1 pages 82530000 - 82540000 (65536 bytes) + 84 CODE 1 pages 82540000 - 82550000 (65536 bytes) + 85 CODE 1 pages 82550000 - 82560000 (65536 bytes) + 86 CODE 1 pages 82560000 - 82570000 (65536 bytes) + 87 CODE 1 pages 82570000 - 82580000 (65536 bytes) + 88 CODE 1 pages 82580000 - 82590000 (65536 bytes) + 89 CODE 1 pages 82590000 - 825A0000 (65536 bytes) + 90 CODE 1 pages 825A0000 - 825B0000 (65536 bytes) + 91 CODE 1 pages 825B0000 - 825C0000 (65536 bytes) + 92 CODE 1 pages 825C0000 - 825D0000 (65536 bytes) + 93 CODE 1 pages 825D0000 - 825E0000 (65536 bytes) + 94 CODE 1 pages 825E0000 - 825F0000 (65536 bytes) + 95 CODE 1 pages 825F0000 - 82600000 (65536 bytes) + 96 CODE 1 pages 82600000 - 82610000 (65536 bytes) + 97 CODE 1 pages 82610000 - 82620000 (65536 bytes) + 98 CODE 1 pages 82620000 - 82630000 (65536 bytes) + 99 CODE 1 pages 82630000 - 82640000 (65536 bytes) + 100 CODE 1 pages 82640000 - 82650000 (65536 bytes) + 101 CODE 1 pages 82650000 - 82660000 (65536 bytes) + 102 CODE 1 pages 82660000 - 82670000 (65536 bytes) + 103 CODE 1 pages 82670000 - 82680000 (65536 bytes) + 104 CODE 1 pages 82680000 - 82690000 (65536 bytes) + 105 CODE 1 pages 82690000 - 826A0000 (65536 bytes) + 106 CODE 1 pages 826A0000 - 826B0000 (65536 bytes) + 107 CODE 1 pages 826B0000 - 826C0000 (65536 bytes) + 108 CODE 1 pages 826C0000 - 826D0000 (65536 bytes) + 109 CODE 1 pages 826D0000 - 826E0000 (65536 bytes) + 110 CODE 1 pages 826E0000 - 826F0000 (65536 bytes) + 111 CODE 1 pages 826F0000 - 82700000 (65536 bytes) + 112 CODE 1 pages 82700000 - 82710000 (65536 bytes) + 113 CODE 1 pages 82710000 - 82720000 (65536 bytes) + 114 CODE 1 pages 82720000 - 82730000 (65536 bytes) + 115 CODE 1 pages 82730000 - 82740000 (65536 bytes) + 116 CODE 1 pages 82740000 - 82750000 (65536 bytes) + 117 CODE 1 pages 82750000 - 82760000 (65536 bytes) + 118 CODE 1 pages 82760000 - 82770000 (65536 bytes) + 119 CODE 1 pages 82770000 - 82780000 (65536 bytes) + 120 CODE 1 pages 82780000 - 82790000 (65536 bytes) + 121 CODE 1 pages 82790000 - 827A0000 (65536 bytes) + 122 CODE 1 pages 827A0000 - 827B0000 (65536 bytes) + 123 CODE 1 pages 827B0000 - 827C0000 (65536 bytes) + 124 CODE 1 pages 827C0000 - 827D0000 (65536 bytes) + 125 CODE 1 pages 827D0000 - 827E0000 (65536 bytes) + 126 CODE 1 pages 827E0000 - 827F0000 (65536 bytes) + 127 CODE 1 pages 827F0000 - 82800000 (65536 bytes) + 128 CODE 1 pages 82800000 - 82810000 (65536 bytes) + 129 CODE 1 pages 82810000 - 82820000 (65536 bytes) + 130 CODE 1 pages 82820000 - 82830000 (65536 bytes) + 131 CODE 1 pages 82830000 - 82840000 (65536 bytes) + 132 CODE 1 pages 82840000 - 82850000 (65536 bytes) + 133 CODE 1 pages 82850000 - 82860000 (65536 bytes) + 134 CODE 1 pages 82860000 - 82870000 (65536 bytes) + 135 RWDATA 1 pages 82870000 - 82880000 (65536 bytes) + 136 RWDATA 1 pages 82880000 - 82890000 (65536 bytes) + 137 RWDATA 1 pages 82890000 - 828A0000 (65536 bytes) + 138 RWDATA 1 pages 828A0000 - 828B0000 (65536 bytes) + 139 RWDATA 1 pages 828B0000 - 828C0000 (65536 bytes) + 140 RWDATA 1 pages 828C0000 - 828D0000 (65536 bytes) + 141 RWDATA 1 pages 828D0000 - 828E0000 (65536 bytes) + 142 RWDATA 1 pages 828E0000 - 828F0000 (65536 bytes) + 143 RWDATA 1 pages 828F0000 - 82900000 (65536 bytes) + 144 RWDATA 1 pages 82900000 - 82910000 (65536 bytes) + 145 RWDATA 1 pages 82910000 - 82920000 (65536 bytes) +Imports: + xam - 52 imports + Version: 0.0.4552.32 + Min Version: 0.0.4552.32 + + Total: 52 + Known: 100% (52 known, 0 unknown) + Implemented: 98% (51 implemented, 1 unimplemented) + + F 82000600 8284DA7C 28C ( 652) XNotifyPositionUI + F 82000604 8284DA8C 2BC ( 700) XamShowSigninUI + F 82000608 8284DA9C 2C1 ( 705) XamShowKeyboardUI + F 8200060C 8284DAAC 2D5 ( 725) !! XamShowGamerCardUIForXUID + F 82000610 8284DABC 2CB ( 715) XamShowDeviceSelectorUI + F 82000614 8284DACC 2D9 ( 729) XamShowDirtyDiscErrorUI + F 82000618 8284DADC 1B3 ( 435) XamTaskShouldExit + F 8200061C 8284DAEC 1B1 ( 433) XamTaskCloseHandle + F 82000620 8284DAFC 1AF ( 431) XamTaskSchedule + F 82000624 8284DB0C 1A4 ( 420) XamLoaderLaunchTitle + F 82000628 8284DB1C 1F7 ( 503) XMsgStartIORequest + F 8200062C 8284DB2C 20E ( 526) XamUserGetName + F 82000630 8284DB3C 210 ( 528) XamUserGetSigninState + F 82000634 8284DB4C 282 ( 642) XamGetSystemVersion + F 82000638 8284DB5C 2F7 ( 759) XamUserCreateStatsEnumerator + F 8200063C 8284DB6C 2EE ( 750) XamUserCreateAchievementEnumerator + F 82000640 8284DB7C 20A ( 522) XamUserGetXUID + F 82000644 8284DB8C 250 ( 592) XamEnumerate + F 82000648 8284DB9C 3CC ( 972) XGetGameRegion + F 8200064C 8284DBAC 190 ( 400) XamInputGetCapabilities + F 82000650 8284DBBC 191 ( 401) XamInputGetState + F 82000654 8284DBCC 192 ( 402) XamInputSetState + F 82000658 8284DBDC 198 ( 408) XamInputGetKeystrokeEx + F 8200065C 8284DBEC 258 ( 600) XamContentCreate + F 82000660 8284DBFC 25B ( 603) XamContentDelete + F 82000664 8284DC0C 25A ( 602) XamContentClose + F 82000668 8284DC1C 260 ( 608) XamContentSetThumbnail + F 8200066C 8284DC2C 262 ( 610) XamContentGetCreator + F 82000670 8284DC3C 25C ( 604) XamContentCreateEnumerator + F 82000674 8284DC4C 265 ( 613) XamContentGetDeviceState + F 82000678 8284DC5C 25E ( 606) XamContentGetDeviceData + F 8200067C 8284DC6C 25F ( 607) XamContentGetDeviceName + F 82000680 8284DC7C 1A0 ( 416) XamEnableInactivityProcessing + F 82000684 8284DC8C 1A1 ( 417) XamResetInactivity + F 82000688 8284DC9C 2DC ( 732) XamShowMessageBoxUIEx + F 8200068C 8284DCAC 3CD ( 973) XGetLanguage + F 82000690 8284DCBC 3CB ( 971) XGetAVPack + F 82000694 8284DCCC 1A9 ( 425) XamLoaderTerminateTitle + F 82000698 8284DCDC 280 ( 640) XamGetExecutionId + F 8200069C 8284E45C 28B ( 651) XNotifyGetNext + F 820006A0 8284E44C 002 ( 2) NetDll_WSACleanup + F 820006A4 8284E43C 001 ( 1) NetDll_WSAStartup + F 820006A8 8284E46C 28A ( 650) XamNotifyCreateListener + F 820006AC 8284E42C 316 ( 790) XamSessionCreateHandle + F 820006B0 8284E41C 317 ( 791) XamSessionRefObjByHandle + F 820006B4 8284E40C 21A ( 538) XamUserWriteProfileSettings + F 820006B8 8284E3FC 219 ( 537) XamUserReadProfileSettings + F 820006BC 8284E3EC 1EA ( 490) XamAlloc + F 820006C0 8284E3DC 1EC ( 492) XamFree + F 820006C4 8284E3CC 3D1 ( 977) XGetVideoMode + F 820006C8 8284E3BC 1F4 ( 500) XMsgInProcessCall + F 820006CC 8284E3AC 1FC ( 508) XMsgStartIORequestEx + + xboxkrnl - 152 imports + Version: 0.0.4552.32 + Min Version: 0.0.4552.32 + + Total: 152 + Known: 100% (152 known, 0 unknown) + Implemented: 95% (145 implemented, 7 unimplemented) + + F 820006D4 8284E1FC 0B4 ( 180) KfReleaseSpinLock + F 820006D8 8284E20C 0B1 ( 177) KfAcquireSpinLock + F 820006DC 8284E21C 1DF ( 479) KiApcNormalRoutineNop + F 820006E0 8284E22C 1B6 ( 438) VdEnableRingBufferRPtrWriteBack + F 820006E4 8284E23C 1C3 ( 451) VdInitializeRingBuffer + F 820006E8 8284E24C 0BE ( 190) MmGetPhysicalAddress + F 820006EC 8284E25C 1D9 ( 473) VdSetSystemCommandBufferGpuIdentifierAddress + F 820006F0 8284E26C 13B ( 315) sprintf + F 820006F4 8284E27C 1B9 ( 441) VdGetCurrentDisplayGamma + V 820006F8 266 ( 614) KeCertMonitorData + F 820006FC 8284E28C 14D ( 333) _vsnprintf + V 82000700 158 ( 344) XboxKrnlVersion + F 82000704 8284E29C 1DC ( 476) VdShutdownEngines + F 82000708 8284E2AC 1CA ( 458) VdQueryVideoMode + F 8200070C 8284E2BC 1BA ( 442) VdGetCurrentDisplayInformation + F 82000710 8284E2CC 1D3 ( 467) VdSetDisplayMode + F 82000714 8284E2DC 1D5 ( 469) VdSetGraphicsInterruptCallback + F 82000718 8284E2EC 1C2 ( 450) VdInitializeEngines + F 8200071C 8284E2FC 1C6 ( 454) VdIsHSIOTrainingSucceeded + F 82000720 8284E30C 1C9 ( 457) VdQueryVideoFlags + F 82000724 8284E31C 1B1 ( 433) VdCallGraphicsNotificationRoutines + V 82000728 1C0 ( 448) VdGpuClockInMHz + F 8200072C 8284E32C 1C5 ( 453) VdInitializeScalerCommandBuffer + F 82000730 8284E33C 269 ( 617) VdRetrainEDRAM + F 82000734 8284E34C 26A ( 618) VdRetrainEDRAMWorker + V 82000738 1C1 ( 449) VdHSIOCalibrationLock + F 8200073C 8284E35C 06B ( 107) KeLockL2 + F 82000740 8284E36C 06C ( 108) KeUnlockL2 + F 82000744 8284E37C 1C7 ( 455) VdPersistDisplay + F 82000748 8284E38C 25B ( 603) VdSwap + F 8200074C 8284E39C 1BD ( 445) VdGetSystemCommandBuffer + V 82000750 1BE ( 446) VdGlobalDevice + F 82000754 8284E1EC 04D ( 77) KeAcquireSpinLockAtRaisedIrql + F 82000758 8284E1DC 089 ( 137) KeReleaseSpinLockFromRaisedIrql + F 8200075C 8284E1CC 1B4 ( 436) VdEnableDisableClockGating + F 82000760 8284E1BC 13F ( 319) RtlTimeFieldsToTime + F 82000764 8284E1AC 136 ( 310) RtlRaiseException + F 82000768 8284E19C 0EE ( 238) NtQueryVirtualMemory + F 8200076C 8284E18C 11B ( 283) RtlCompareMemoryUlong + F 82000770 8284E17C 066 ( 102) KeGetCurrentProcessType + F 82000774 8284E16C 053 ( 83) KeBugCheckEx + F 82000778 8284E15C 126 ( 294) RtlFillMemoryUlong + V 8200077C 1AE ( 430) ExLoadedCommandLine + F 82000780 8284E14C 05A ( 90) KeDelayExecutionThread + F 82000784 8284E13C 143 ( 323) RtlUnicodeToMultiByteN + F 82000788 8284E12C 0E4 ( 228) NtQueryDirectoryFile + F 8200078C 8284E10C 019 ( 25) ExTerminateThread + F 82000790 8284E0FC 09B ( 155) KeSetCurrentStackPointers + F 82000794 8284E0EC 197 ( 407) XexGetProcedureAddress + F 82000798 8284E0DC 03C ( 60) !! IoDismountVolumeByFileHandle + F 8200079C 8284E0CC 0D9 ( 217) NtDeviceIoControlFile + F 820007A0 8284E0BC 028 ( 40) HalReturnToFirmware + F 820007A4 8284E0AC 003 ( 3) DbgPrint + F 820007A8 8284E09C 140 ( 320) RtlTimeToTimeFields + F 820007AC 8284E08C 0FE ( 254) NtWaitForMultipleObjectsEx + F 820007B0 8284E07C 0F3 ( 243) NtReleaseSemaphore + F 820007B4 8284E06C 0D5 ( 213) NtCreateSemaphore + F 820007B8 8284E05C 084 ( 132) KeQuerySystemTime + F 820007BC 8284E04C 0E8 ( 232) NtQueryInformationFile + F 820007C0 8284E03C 0F7 ( 247) NtSetInformationFile + F 820007C4 8284E02C 0FD ( 253) NtWaitForSingleObjectEx + F 820007C8 8284E01C 0CE ( 206) NtClearEvent + F 820007CC 8284E00C 0F5 ( 245) NtResumeThread + V 820007D0 0AD ( 173) KeTimeStampBundle + F 820007D4 8284DFFC 010 ( 16) ExGetXConfigSetting + V 820007D8 059 ( 89) KeDebugMonitorData + F 820007DC 8284DFEC 097 ( 151) KeSetAffinityThread + F 820007E0 8284DFDC 0FC ( 252) NtSuspendThread + F 820007E4 8284DFCC 081 ( 129) KeQueryBasePriorityThread + V 820007E8 01B ( 27) ExThreadObjectType + F 820007EC 8284DFBC 110 ( 272) ObReferenceObjectByHandle + F 820007F0 8284DFAC 099 ( 153) KeSetBasePriorityThread + F 820007F4 8284DF9C 10B ( 267) ObLookupThreadByThreadId + F 820007F8 8284DF8C 10E ( 270) ObOpenObjectByPointer + F 820007FC 8284DF7C 0DA ( 218) NtDuplicateObject + F 82000800 8284DF6C 101 ( 257) NtYieldExecution + F 82000804 8284DF5C 0F6 ( 246) NtSetEvent + F 82000808 8284DF4C 052 ( 82) KeBugCheck + F 8200080C 8284DF3C 0BC ( 188) MmDeleteKernelStack + F 82000810 8284DF2C 0BB ( 187) MmCreateKernelStack + F 82000814 8284DF1C 0D1 ( 209) NtCreateEvent + F 82000818 8284DF0C 135 ( 309) RtlNtStatusToDosError + F 8200081C 8284DEFC 194 ( 404) XexCheckExecutablePrivilege + F 82000820 8284DEEC 05F ( 95) KeEnterCriticalRegion + F 82000824 8284DEDC 07D ( 125) KeLeaveCriticalRegion + F 82000828 8284DECC 0CC ( 204) NtAllocateVirtualMemory + F 8200082C 8284DEBC 259 ( 601) !! StfsCreateDevice + F 82000830 8284DEAC 103 ( 259) ObCreateSymbolicLink + F 82000834 8284DE9C 25A ( 602) !! StfsControlDevice + F 82000838 8284DE8C 0DB ( 219) NtFlushBuffersFile + F 8200083C 8284DE7C 104 ( 260) ObDeleteSymbolicLink + F 82000840 8284DE6C 105 ( 261) ObDereferenceObject + F 82000844 8284DE5C 0DC ( 220) NtFreeVirtualMemory + F 82000848 8284DE4C 0D2 ( 210) NtCreateFile + F 8200084C 8284DE3C 256 ( 598) XeKeysConsolePrivateKeySign + F 82000850 8284DE2C 0F0 ( 240) NtReadFile + F 82000854 8284DE1C 0FF ( 255) NtWriteFile + F 82000858 8284DE0C 192 ( 402) XeCryptSha + F 8200085C 8284DDFC 257 ( 599) !! XeKeysConsoleSignatureVerification + F 82000860 8284DDEC 015 ( 21) ExRegisterTitleTerminateNotification + F 82000864 8284DDDC 09D ( 157) KeSetEvent + F 82000868 8284DDCC 0B0 ( 176) KeWaitForSingleObject + F 8200086C 8284DDBC 08F ( 143) KeResetEvent + V 82000870 193 ( 403) XexExecutableModuleHandle + F 82000874 8284DDAC 12B ( 299) RtlImageXexHeaderField + F 82000878 8284DD9C 1A5 ( 421) !! __C_specific_handler + F 8200087C 8284DD8C 12C ( 300) RtlInitAnsiString + F 82000880 8284DD7C 0DF ( 223) NtOpenFile + F 82000884 8284DD6C 0CF ( 207) NtClose + F 82000888 8284DD5C 0EF ( 239) NtQueryVolumeInformationFile + F 8200088C 8284DD4C 0C4 ( 196) MmQueryAddressProtect + F 82000890 8284DD3C 0BD ( 189) MmFreePhysicalMemory + F 82000894 8284DD2C 0BA ( 186) MmAllocatePhysicalMemoryEx + F 82000898 8284DD1C 12E ( 302) RtlInitializeCriticalSection + F 8200089C 8284DD0C 130 ( 304) RtlLeaveCriticalSection + F 820008A0 8284DCFC 125 ( 293) RtlEnterCriticalSection + F 820008A4 8284DCEC 12F ( 303) RtlInitializeCriticalSectionAndSpinCount + F 820008A8 8284E11C 00D ( 13) ExCreateThread + F 820008AC 8284E47C 085 ( 133) KeRaiseIrqlToDpcLevel + F 820008B0 8284E48C 0B3 ( 179) KfLowerIrql + F 820008B4 8284E49C 088 ( 136) KeReleaseSemaphore + F 820008B8 8284E4AC 1F8 ( 504) XAudioGetVoiceCategoryVolume + F 820008BC 8284E4BC 1F7 ( 503) XAudioGetVoiceCategoryVolumeChangeMask + F 820008C0 8284E4CC 0AF ( 175) KeWaitForMultipleObjects + F 820008C4 8284E4DC 092 ( 146) KeResumeThread + F 820008C8 8284E4EC 074 ( 116) KeInitializeSemaphore + F 820008CC 8284E4FC 226 ( 550) XMAReleaseContext + F 820008D0 8284E50C 224 ( 548) XMACreateContext + F 820008D4 8284E51C 083 ( 131) KeQueryPerformanceFrequency + F 820008D8 8284E52C 141 ( 321) RtlTryEnterCriticalSection + F 820008DC 8284E53C 0AE ( 174) KeTryToAcquireSpinLockAtRaisedIrql + F 820008E0 8284E54C 1F3 ( 499) XAudioRegisterRenderDriverClient + F 820008E4 8284E55C 1F4 ( 500) XAudioUnregisterRenderDriverClient + F 820008E8 8284E56C 1F5 ( 501) XAudioSubmitRenderDriverFrame + F 820008EC 8284E57C 195 ( 405) XexGetModuleHandle + F 820008F0 8284E58C 147 ( 327) !! RtlUnwind + F 820008F4 8284E59C 152 ( 338) KeTlsAlloc + F 820008F8 8284E5AC 154 ( 340) KeTlsGetValue + F 820008FC 8284E5BC 155 ( 341) KeTlsSetValue + F 82000900 8284E5CC 153 ( 339) KeTlsFree + F 82000904 8284E5DC 119 ( 281) !! RtlCaptureContext + F 82000908 8284E5EC 05D ( 93) KeEnableFpuExceptions + F 8200090C 8284E5FC 0C6 ( 198) MmQueryStatistics + F 82000910 8284E60C 0D7 ( 215) NtCreateTimer + F 82000914 8284E61C 0FA ( 250) NtSetTimerEx + F 82000918 8284E62C 0CD ( 205) NtCancelTimer + F 8200091C 8284E63C 0E7 ( 231) NtQueryFullAttributesFile + F 82000920 8284E64C 127 ( 295) RtlFreeAnsiString + F 82000924 8284E65C 142 ( 322) RtlUnicodeStringToAnsiString + F 82000928 8284E66C 12D ( 301) RtlInitUnicodeString + F 8200092C 8284E67C 133 ( 307) RtlMultiByteToUnicodeN + F 82000930 8284E68C 001 ( 1) DbgBreakPoint + +w> 000000D4 GameDatabase: Title doesn't contain XLAST data! Multiplayer functionality might be limited. +i> 000000D4 Title name: PROJECT SYLPHEED +i> 000000D4 +-------------------- ACHIEVEMENTS -------------------- ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| ID | Title | Description | Type | Gamerscore | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 1 | Space Combat Award | Received after your first space battle in the Glasner Training Area. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 2 | Schlos Base Defense Award | Received for stopping the missile attack on Schlos Base. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 3 | Aegis of the People Medal | Received for escorting all 7 refugee ships to safety. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 4 | TCAF Luna Medal | Received for bravely helping the fleet escape during the invasion of the Matisse System. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 5 | TCAF Mars Medal | Received for bravery beyond the call of duty during the escape from the Matisse System. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 6 | Soldier's Charm Amulet | Given to you by Raymond as a token of his trust. | Event | 50 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 7 | White Griffons Patch | Received by the commander and pilots of the White Griffon Squadron when it is formed. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 8 | TCAF Jupiter Medal | Received for bravery during the enemy's attack on the Alberti System. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 9 | Furious Pursuit Badge | Received for continuing attacks on the enemy and shooting down a large number of ships. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 10 | Solo Aerospace Combat Award | Received for descending into Acheron's atmosphere and engaging in combat alone. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 11 | Operation Nebula Blaze Award | Received for completing the extremely hazardous Operation Nebula Blaze. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 12 | Guilty Roses Patch | Received for repelling the Guilty Roses Squadron. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 13 | Super Battleship Slayer Patch | Received for shooting down the second S battleship. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 14 | TCAF Terra Medal | Received for shielding the fleet and seeing that all ships safely fled the Ingres System. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 15 | Hellfires Patch | Received for repelling the enemy Hellfire Squadron. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 16 | Night Ravens Patch | Received for challenging and eradicating the Night Raven Squadron. | Event | 50 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 17 | Solar System Defense Award | Received for great achievements during the campaign to defend the Solar System. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 18 | Special Operations Medal | Received for heroically destroying the Prometheus Driver. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 19 | 1,000 Units Destroyed Medal | Received for shooting down 1,000 enemy fighters and attackers in combat. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 20 | 10,000 Units Destroyed Medal | Received for shooting down 10,000 enemy fighters and attackers in combat. | Event | 70 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 21 | Ship Hunter Award | Received for shooting down 100 enemy warships in combat. | Event | 50 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 22 | Gigaton Club Patch | Received for shooting down enemy vessels with a total weight of one gigaton. | Event | 70 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 23 | Weapon Lord Patch | Received after you collect all usable equipment for the Delta Saber. | Event | 80 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 24 | TCAF Pilot's Commendation | Commemmorates you as one of the greatest pilots in history. | Event | 100 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +i> 000000D4 +-------------------- PROPERTIES -------------------- ++----------+------------------+-------------+-----------+ +| ID | Name | Matchmaking | Data Size | ++----------+------------------+-------------+-----------+ +| 10000006 | Killed Aircrafts | False | 4 | ++----------+------------------+-------------+-----------+ +| 10000008 | Equipments | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000000A | Clear Time | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000000B | Killed Warships | False | 4 | ++----------+------------------+-------------+-----------+ +| 10008001 | Rank | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000800A | | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000800B | | False | 4 | ++----------+------------------+-------------+-----------+ +| 20000005 | Killed Weight | False | 8 | ++----------+------------------+-------------+-----------+ +| 20000007 | Clear Time | False | 8 | ++----------+------------------+-------------+-----------+ +| 20000009 | Earned Points | False | 8 | ++----------+------------------+-------------+-----------+ +| 40008002 | Gamer Name | False | 2 | ++----------+------------------+-------------+-----------+ +i> 000000D4 +-------------------- CONTEXTS -------------------- ++----------+-------------+-------------+---------------+-----------+ +| ID | Name | Matchmaking | Default Value | Max Value | ++----------+-------------+-------------+---------------+-----------+ +| 00000000 | Game Stage | False | 0 | 28 | ++----------+-------------+-------------+---------------+-----------+ +| 00000001 | Game Status | False | 0 | 9 | ++----------+-------------+-------------+---------------+-----------+ +| 00008001 | | False | 0 | 0 | ++----------+-------------+-------------+---------------+-----------+ +| 0000800A | Game Type | True | 0 | 1 | ++----------+-------------+-------------+---------------+-----------+ +| 0000800B | | True | 0 | 0 | ++----------+-------------+-------------+---------------+-----------+ +i> 000000D4 +-------------------- STATS VIEWS -------------------- ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| ID | View Type | Name | Skilled | Arbitrated | Hidden | Team View | Online Only | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000001 | Leaderboard | Time Attack (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000002 | Leaderboard | Score Attack (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000003 | Leaderboard | Extra 1 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000004 | Leaderboard | Extra 1 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000005 | Leaderboard | Extra 2 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000006 | Leaderboard | Extra 2 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000007 | Leaderboard | Extra 3 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000008 | Leaderboard | Extra 3 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000009 | Leaderboard | Extra 4 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 0000000A | Leaderboard | Extra 4 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 0000000C | Leaderboard | Time Attack (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 0000000D | Leaderboard | Score Attack (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| FFFF0000 | Leaderboard | | True | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +i> 000000D4 +-------------------- PRESENCE MODES -------------------- ++---------------+----------------+------------------+ +| Context Value | Contexts Count | Properties Count | ++---------------+----------------+------------------+ +| 0 | 2 | 0 | ++---------------+----------------+------------------+ +i> 000000D4 XThread01000020 (5) Stack: 70110000-70130000 +i> 000000D4 KernelState: Launching module... +i> 000000D4 XThreadF8000008 (6) Stack: 70150000-701D0000 +K> 01000020 XThread::Execute thid 5 (handle=01000020, 'Kernel Dispatch (01000020)', native=00000190, ) +K> F8000008 XThread::Execute thid 6 (handle=F8000008, 'Main XThread (F8000008)', native=00000194) +i> 01000010 Loaded 7 shaders from storage +i> 01000010 Loaded 4 pipeline descriptions, 8 shader translations needed +i> 01000010 Translated 7 shaders in 3 ms +i> 01000010 Pipeline cache loaded: 4 created, 0 already exist, 4 total stored +i> 01000010 Pipeline creation took 0 milliseconds +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800000C type=1 initial_state=0 lr=824A9F6C +F> F8000008 NullDevice::ResolvePath() +F> F8000008 NullDevice::ResolvePath() +F> F8000008 NullDevice::ResolvePath() +!> F8000008 undefined extern call to 8284E0DC IoDismountVolumeByFileHandle +F> F8000008 NullDevice::ResolvePath() +i> F8000008 Got xam task args: v1 = 02080002, v2 = 00000000 +i> F8000008 XThreadF8000010 (7) Stack: 701F0000-70270000 +K> F8000010 XThread::Execute thid 7 (handle=F8000010, 'XThread01B8 (F8000010)', native=000001B8) +F> F8000010 NullDevice::ResolvePath() +w> F8000010 Game is attempting to allocate devkit debug memory (base: 00000000, size: 000FF000). Ignoring debug flag and using normal allocation. +!> F8000010 undefined extern call to 8284DEBC StfsCreateDevice +K> F8000010 AUDIT-HLC KeSetEvent guest_ptr=8287094C lr=824A95D0 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000020 type=1 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000024 (8) Stack: 70290000-702B0000 +K> F8000024 XThread::Execute thid 8 (handle=F8000024, 'XThread01BC (F8000024)', native=000001BC) +K> F8000024 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000020 alertable=0 lr=824AC578 guest_lr=824AFFC4 +F> F8000008 HostPathDevice::ResolvePath() +i> F8000008 XThreadF800002C (9) Stack: 702D0000-702E0000 +K> F800002C XThread::Execute thid 9 (handle=F800002C, 'XThread01C0 (F800002C)', native=000001C0) +F> F800002C HostPathDevice::ResolvePath() +F> F800002C HostPathDevice::ResolvePath() +F> F8000008 HostPathDevice::ResolvePath(\d4ea4615\e\46ee8ca) +F> F8000008 HostPathDevice::ResolvePath(\d4ea4615\e) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800003C type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000040 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000048 (A) Stack: 70300000-70340000 +K> F8000048 XThread::Execute thid 10 (handle=F8000048, 'XThread01C4 (F8000048)', native=000001C4) +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800003C alertable=0 lr=824AC578 guest_lr=82452E64 +!> F800002C BaseHeap::Release failed because address is not a region start +!> F800002C PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000030 type=0 initial_state=0 lr=824A9F6C +F> F800002C HostPathDevice::ResolvePath() +F> F800002C HostPathDevice::ResolvePath() +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F800004C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800003C result=00000000 lr=824AC578 guest_lr=82452E64 +!> F800002C BaseHeap::Release failed because address is not a region start +!> F800002C PhysicalHeap::Release failed due to parent heap failure +K> F800002C AUDIT-HLC NtWaitForSingleObjectEx handle=F8000028 alertable=0 lr=824AC578 guest_lr=824AFFC4 +!> F8000008 BaseHeap::Release failed because address is not a region start +!> F8000008 PhysicalHeap::Release failed due to parent heap failure +!> F8000008 BaseHeap::Release failed because address is not a region start +!> F8000008 PhysicalHeap::Release failed due to parent heap failure +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\8\3421153) +F> F8000008 DiscImageDevice::ResolvePath(\dat) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\355f2f8) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000038 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800004C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800004C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000050 type=0 initial_state=0 lr=824A9F6C +i> F8000048 XThreadF8000058 (B) Stack: 70360000-70370000 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F800004C alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 XThread::Execute thid 11 (handle=F8000058, 'XThread01C8 (F8000058)', native=000001C8) +K> F8000058 AUDIT-HLC NtSetEvent handle=F800004C lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800004C result=00000000 lr=824AC578 guest_lr=8245148C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F800003C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=82452E64 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000038 type=1 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +i> F8000008 XThreadF800004C (C) Stack: 70390000-703A0000 +K> F800004C XThread::Execute thid 12 (handle=F800004C, 'XThread01CC (F800004C)', native=000001CC) +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +i> F8000008 Hardware scaler: width ratio 1:1, height ratio 1:1, final aspect ratio 16:9 +i> 01000010 Selecting rep movs vastcpy. +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000060 type=1 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000064 type=1 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000068 (D) Stack: 703C0000-70440000 +K> F8000068 XThread::Execute thid 13 (handle=F8000068, 'XThread01D0 (F8000068)', native=000001D0) +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +F> F8000008 HostPathDevice::ResolvePath(\aab216c3\a\2c8c185) +F> F8000008 HostPathDevice::ResolvePath(\aab216c3\a) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000070 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000070 alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000078 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 AUDIT-HLC NtSetEvent handle=F8000078 lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000078 result=00000000 lr=824AC578 guest_lr=8245148C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000074 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000070 result=00000000 lr=824AC578 guest_lr=82452E64 +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\73a5c0a) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000070 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000070 alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000078 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 AUDIT-HLC NtSetEvent handle=F8000078 lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000078 result=00000000 lr=824AC578 guest_lr=8245148C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000074 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000070 result=00000000 lr=824AC578 guest_lr=82452E64 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +i> F8000008 XThreadF8000070 (E) Stack: 70460000-704E0000 +i> F8000008 XThreadF8000074 (F) Stack: 70500000-70580000 +K> F8000070 XThread::Execute thid 14 (handle=F8000070, 'XThread01D4 (F8000070)', native=000001D4) +K> F8000074 XThread::Execute thid 15 (handle=F8000074, 'XThread01D8 (F8000074)', native=000001D8) +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +i> F8000008 AudioSystem::RegisterClient: driver created for index=0, driver=0x737b76010040 +i> F8000008 AudioSystem::RegisterClient: client 0 registered successfully +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000088 type=0 initial_state=0 lr=824A9F6C +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\39a9dcc) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000088 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000090 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000088 result=00000000 lr=824AC578 guest_lr=8245FA10 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000088 type=0 initial_state=0 lr=824A9F6C +F> F8000008 DiscImageDevice::ResolvePath(\dat) +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000090 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000088 alertable=0 lr=824AC578 guest_lr=82460150 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000088 result=00000000 lr=824AC578 guest_lr=82460150 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000088 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000088 alertable=0 lr=824AC578 guest_lr=82179148 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000090 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000088 result=00000000 lr=824AC578 guest_lr=82179148 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +i> F8000008 XThreadF8000088 (10) Stack: 705A0000-705B0000 +K> F8000088 XThread::Execute thid 16 (handle=F8000088, 'XThread01EC (F8000088)', native=000001EC) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000094 alertable=0 lr=824AC578 guest_lr=82173BD4 +K> F8000068 AUDIT-HLC NtSetEvent handle=F8000094 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000094 result=00000000 lr=824AC578 guest_lr=82173BD4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000098 (11) Stack: 705D0000-70650000 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000098 alertable=0 lr=824AC578 guest_lr=822F1B50 +K> F8000098 XThread::Execute thid 17 (handle=F8000098, 'XThread01F0 (F8000098)', native=000001F0) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F800009C type=1 initial_state=1 lr=824A9F6C +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000A0 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\aab216c3\5\ee70e0a) +F> F8000098 HostPathDevice::ResolvePath(\aab216c3\5) +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A0 alertable=0 lr=824AC578 guest_lr=821CBAE0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000AC alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 AUDIT-HLC NtSetEvent handle=F80000AC lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000AC result=00000000 lr=824AC578 guest_lr=8245148C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000A8 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000A0 result=00000000 lr=824AC578 guest_lr=821CBAE0 +i> F8000098 XThreadF80000A0 (12) Stack: 70670000-70680000 +K> F80000A0 XThread::Execute thid 18 (handle=F80000A0, 'XThread01F4 (F80000A0)', native=000001F4) +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +i> F80000A0 XThreadF80000A8 (13) Stack: 706A0000-706D0000 +i> F80000A0 XThreadF80000AC (14) Stack: 706F0000-70720000 +K> F80000A8 XThread::Execute thid 19 (handle=F80000A8, 'XThread01F8 (F80000A8)', native=000001F8) +K> F80000AC XThread::Execute thid 20 (handle=F80000AC, 'XThread01FC (F80000AC)', native=000001FC) +K> F80000AC AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A4 alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F80000A8 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A4 alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\c\dba806e) +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +F> F8000098 HostPathDevice::ResolvePath(\87719002\c) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\c\ec0a96e) +F> F8000098 HostPathDevice::ResolvePath(\87719002\c) +F> F80000A0 DiscImageDevice::ResolvePath(\hidden\Resource3D) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000CC type=0 initial_state=0 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000D0 type=1 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\a\60fcb85) +F> F8000098 HostPathDevice::ResolvePath(\87719002\a) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFCC8 +F> F8000098 HostPathDevice::ResolvePath(\87719002\2\85d8849) +F> F8000098 HostPathDevice::ResolvePath(\87719002\2) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\a\715f485) +F> F8000098 HostPathDevice::ResolvePath(\87719002\a) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000F8 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\c\f2a8ccd) +F> F8000098 HostPathDevice::ResolvePath(\87719002\c) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\0\1a2db9c) +F> F8000098 HostPathDevice::ResolvePath(\87719002\0) +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000EC alertable=0 lr=824AC578 guest_lr=821C515C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000B8 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000C4 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000E0 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFCC8 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFE24 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000E8 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000F4 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000EC result=00000000 lr=824AC578 guest_lr=821C515C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000100 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000098 result=00000000 lr=824AC578 guest_lr=822F1B50 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F800010C lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000B4 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFE24 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFED0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000098 (15) Stack: 705D0000-705E0000 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C4 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000098 XThread::Execute thid 21 (handle=F8000098, 'XThread0200 (F8000098)', native=00000200) +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C4 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000094 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFED0 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000094 type=1 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +i> F8000008 XThreadF80000C0 (16) Stack: 70600000-70610000 +K> F80000C0 XThread::Execute thid 22 (handle=F80000C0, 'XThread0204 (F80000C0)', native=00000204) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000C8 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C8 alertable=0 lr=824AC578 guest_lr=82172BC8 +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000C8 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C8 result=00000000 lr=824AC578 guest_lr=82172BC8 +K> F80000C0 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000094 alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +F> F80000A0 DiscImageDevice::ResolvePath(\hidden\Resource3D) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000D0 type=1 initial_state=0 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFCC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D4 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFCC8 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFE24 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D4 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFE24 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFED0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000E8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF80000D8 (17) Stack: 70630000-70640000 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F80000D8 XThread::Execute thid 23 (handle=F80000D8, 'XThread0208 (F80000D8)', native=00000208) +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000F4 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000100 (18) Stack: 70740000-707C0000 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF800010C (19) Stack: 707E0000-70860000 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000100 XThread::Execute thid 24 (handle=F8000100, 'XThread020C (F8000100)', native=0000020C) +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F800010C XThread::Execute thid 25 (handle=F800010C, 'XThread0210 (F800010C)', native=00000210) +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D4 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFED0 +F> F80000A0 DiscImageDevice::ResolvePath(\hidden\Resource3D) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000D0 type=1 initial_state=0 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFCC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D4 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFCC8 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFE24 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D4 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFE24 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFED0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D4 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFED0 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\f\ca5c62e) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000C8 type=0 initial_state=0 lr=824A9F6C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\d\14ba3f8) +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\d) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C8 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D4 type=0 initial_state=0 lr=824A9F6C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D4 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C8 result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\8\14c242d) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000C8 type=0 initial_state=0 lr=824A9F6C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\5\6324af0) +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\5) +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C8 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D4 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C8 result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\d\70a9531) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000C8 type=0 initial_state=0 lr=824A9F6C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\a\c9606f9) +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\a) +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C8 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D4 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C8 result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\7\9f2d535) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000C8 type=0 initial_state=0 lr=824A9F6C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\4\efaecd1) +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\4) +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C8 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D4 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C8 result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\7\0c3bba2) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000C8 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\4\59fbfe8) +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\4) +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C8 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D4 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C8 result=00000000 lr=824AC578 guest_lr=8245FA10 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B0 alertable=0 lr=824AC578 guest_lr=821CC19C +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000B0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B0 result=00000000 lr=824AC578 guest_lr=821CC19C +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800009C alertable=0 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800009C result=00000000 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800009C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000BC alertable=0 lr=824AC578 guest_lr=821CC19C +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000BC lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000BC result=00000000 lr=824AC578 guest_lr=821CC19C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800009C alertable=0 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800009C result=00000000 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800009C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF80000C8 (1A) Stack: 70880000-70900000 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F80000C8 XThread::Execute thid 26 (handle=F80000C8, 'XThread0214 (F80000C8)', native=00000214) +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F80000C8 AUDIT-HLC NtCreateEvent handle=F80000D0 type=1 initial_state=1 lr=824A9F6C +K> F80000C8 AUDIT-HLC NtCreateEvent handle=F80000D4 type=0 initial_state=0 lr=824A9F6C +F> F80000C8 HostPathDevice::ResolvePath(\aab216c3\5\c10eae6) +F> F80000C8 HostPathDevice::ResolvePath(\aab216c3\5) +K> F80000C8 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D4 alertable=0 lr=824AC578 guest_lr=821CBAE0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000114 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 AUDIT-HLC NtSetEvent handle=F8000114 lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000114 result=00000000 lr=824AC578 guest_lr=8245148C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000110 lr=824AA304 +K> F80000C8 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D4 result=00000000 lr=824AC578 guest_lr=821CBAE0 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +F> F8000088 DiscImageDevice::ResolvePath(\dat) +K> F8000088 AUDIT-HLC NtSetEvent handle=F8000114 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000F0 alertable=0 lr=824AC578 guest_lr=82460150 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000F0 result=00000000 lr=824AC578 guest_lr=82460150 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000BC alertable=0 lr=824AC578 guest_lr=82172BC8 +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000BC lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000BC result=00000000 lr=824AC578 guest_lr=82172BC8 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +F> F8000008 DiscImageDevice::ResolvePath(\dat\movie) +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000118 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800011C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000120 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000124 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000128 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800012C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000130 type=0 initial_state=1 lr=824A9F6C +F> F8000008 DiscImageDevice::ResolvePath(\dat\movie) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000138 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800013C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000140 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000144 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000148 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800014C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000150 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000154 type=0 initial_state=1 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +i> F8000008 XThreadF8000158 (1B) Stack: 70880000-70890000 +i> F8000008 XThreadF800015C (1C) Stack: 708B0000-708C0000 +i> F8000008 XThreadF8000160 (1D) Stack: 708E0000-708F0000 +i> F8000008 XThreadF8000164 (1E) Stack: 70910000-70920000 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25404 lr=82507ABC +K> F8000158 XThread::Execute thid 27 (handle=F8000158, 'XThread0218 (F8000158)', native=00000218) +K> F800015C XThread::Execute thid 28 (handle=F800015C, 'XThread021C (F800015C)', native=0000021C) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000160 XThread::Execute thid 29 (handle=F8000160, 'XThread0220 (F8000160)', native=00000220) +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C diff --git a/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.stdout.run3 b/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.stdout.run3 new file mode 100644 index 0000000..24192f6 --- /dev/null +++ b/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.stdout.run3 @@ -0,0 +1,36355 @@ +i> 000000D8 Build: canary_experimental@99fd19d02 on Jun 5 2026 +i> 000000D8 Storage root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug +i> 000000D8 ----------- CONFIG DUMP ----------- + +[APU] +apu = "any" +apu_max_queued_frames = 8 +enable_xmp = true +ffmpeg_verbose = false +mute = false +use_dedicated_xma_thread = true +xma_decoder = "new" + +[Auditing] +audit_handle_lifecycle = false +audit_jit_prolog_pc = 0 + +[CPU] +break_condition_gpr = -1 +break_condition_op = "eq" +break_condition_truncate = true +break_condition_value = 0 +break_on_debugbreak = true +break_on_instruction = 0 +break_on_start = false +break_on_unimplemented_instructions = true +clock_no_scaling = false +clock_source_raw = false +cpu = "any" +debug_symbol_loader = false +debugprint_trap_log = false +disable_context_promotion = false +disable_instruction_infocache = false +disable_prefetch_and_cachecontrol = true +disassemble_functions = false +dump_translated_hir_functions = false +elide_e0_check = false +emit_inline_mmio_checks = false +emit_mmio_aware_stores_for_recorded_exception_addresses = true +emit_source_annotations = false +enable_early_precompilation = false +full_optimization_even_with_debug = false +ignore_trap_instructions = true +ignore_undefined_externs = true +inline_loadclock = false +inline_mmio_access = true +load_module_map = "" +no_reserved_ops = false +no_round_to_single = false +permit_float_constant_evaluation = false +pvr = 7407360 +record_mmio_access_exceptions = true +store_all_context_values = false +trace_function_coverage = false +trace_function_data = false +trace_function_data_path = "" +trace_function_references = false +trace_functions = false +use_fast_dot_product = false +validate_hir = false +writable_code_segments = false + +[Config] +defaults_date = 2026040912 + +[Content] +license_mask = 0 + +[D3D12] +d3d12_adapter = -1 +d3d12_allow_variable_refresh_rate_and_tearing = true +d3d12_bindless = true +d3d12_break_on_error = false +d3d12_break_on_warning = false +d3d12_debug = false +d3d12_dxbc_disasm = false +d3d12_dxbc_disasm_dxilconv = false +d3d12_pipeline_creation_threads = -1 +d3d12_queue_priority = 1 +d3d12_submit_on_primary_buffer_end = true +d3d12_tessellation_wireframe = false + +[Display] +fullscreen = false +host_present_from_non_ui_thread = true +postprocess_antialiasing = "" +postprocess_dither = true +postprocess_ffx_cas_additional_sharpness = 0 +postprocess_ffx_fsr_max_upsampling_passes = 4 +postprocess_ffx_fsr_sharpness_reduction = 0.20000000298023224 +postprocess_scaling_and_sharpening = "" +present_letterbox = true +present_render_pass_clear = true +present_safe_area_x = 100 +present_safe_area_y = 100 + +[GPU] +anisotropic_override = -1 +async_shader_compilation = true +clear_memory_page_state = false +depth_float24_convert_in_pixel_shader = false +depth_float24_round = false +depth_transfer_not_equal_test = true +disassemble_pm4 = false +draw_resolution_scale_x = 1 +draw_resolution_scale_y = 1 +draw_resolution_scaled_texture_offsets = true +dump_shaders = "" +dxbc_source_map = false +dxbc_switch = true +execute_unclipped_draw_vs_on_cpu = true +execute_unclipped_draw_vs_on_cpu_for_psi_render_backend = true +execute_unclipped_draw_vs_on_cpu_with_scissor = false +force_convert_line_loops_to_strips = false +force_convert_quad_lists_to_triangle_lists = false +force_convert_triangle_fans_to_lists = false +framerate_limit = 0 +gamma_render_target_as_unorm16 = true +gpu = "any" +gpu_3d_to_2d_texture = true +gpu_allow_invalid_fetch_constants = true +gpu_allow_invalid_upload_range = false +half_pixel_offset = true +ignore_32bit_vertex_index_support = false +log_guest_driven_gpu_register_written_values = false +log_ringbuffer_kickoff_initiator_bts = false +mrt_edram_used_range_clamp_to_min = true +native_2x_msaa = true +native_stencil_value_output = true +native_stencil_value_output_d3d12_intel = false +no_discard_stencil_in_transfer_pipelines = false +non_seamless_cube_map = true +occlusion_query = "fast" +occlusion_query_fake_lower_threshold = 80 +occlusion_query_fake_upper_threshold = 100 +occlusion_query_querybatch_range = 0 +occlusion_query_saturation = 1 +primitive_processor_cache_min_indices = 4096 +readback_memexport = false +readback_resolve = "none" +render_target_path_d3d12 = "" +render_target_path_vulkan = "" +resolve_resolution_scale_fill_half_pixel_offset = true +snorm16_render_target_full_range = true +store_shaders = true +target_trace_file = "" +texture_cache_memory_limit_hard = 768 +texture_cache_memory_limit_render_to_texture = 24 +texture_cache_memory_limit_soft = 384 +texture_cache_memory_limit_soft_lifetime = 30 +tiled_shared_memory = true +trace_dump_path = "" +trace_gpu_prefix = "scratch/gpu/" +trace_gpu_stream = false +use_fuzzy_alpha_epsilon = false +vsync = true + +[General] +allow_game_relative_writes = false +allow_plugins = false +apply_patches = true +controller_hotkeys = false +debug = false +disable_doubleclick_fullscreen = false +discord = true +launch_module = "" +notification_sound_path = "" +priority_class = 0 +recent_titles_entry_amount = 10 +time_scalar = 1 + +[HACKS] +ac6_ground_fix = false + +[HID] +guide_button = true +hid = "any" +keyboard_mode = 0 +keyboard_user_index = 0 +left_stick_deadzone_percentage = 0 +right_stick_deadzone_percentage = 0 +vibration = true + +[HID.WinKey] +keybind_a = "0xBA" +keybind_b = "0xDE" +keybind_back = "Z" +keybind_dpad_down = "^S" +keybind_dpad_left = "^A" +keybind_dpad_right = "^D" +keybind_dpad_up = "^W" +keybind_guide = "0x08" +keybind_left_shoulder = "1" +keybind_left_thumb = "F" +keybind_left_thumb_down = "_S" +keybind_left_thumb_left = "_A" +keybind_left_thumb_right = "_D" +keybind_left_thumb_up = "_W" +keybind_left_trigger = "Q I" +keybind_right_shoulder = "3" +keybind_right_thumb = "K" +keybind_right_thumb_down = "0x28" +keybind_right_thumb_left = "0x25" +keybind_right_thumb_right = "0x27" +keybind_right_thumb_up = "0x26" +keybind_right_trigger = "E O" +keybind_start = "X" +keybind_x = "L" +keybind_y = "P" + +[Kernel] +allow_avatar_initialization = false +allow_incompatible_title_update = true +apply_title_update = true +cl = "" +console_type = 0 +default_achievements_backend = "GPD" +ignore_thread_affinities = true +ignore_thread_priorities = false +kernel_build_version = 1888 +kernel_cert_monitor = false +kernel_debug_monitor = false +kernel_display_gamma_power = 2.22222233 +kernel_display_gamma_type = 2 +kernel_pix = false +staging_mode = false + +[Logging] +enable_console = false +flush_log = true +log_file = "" +log_high_frequency_kernel_calls = false +log_level = 2 +log_mask = 0 +log_string_format_kernel_calls = false +log_to_debugprint = false +log_to_stdout = true + +[Memory] +ignore_offset_for_ranged_allocations = false +protect_on_release = false +protect_zero = true +scribble_heap = false +scribble_heap_value = 0 +writable_executable_memory = true + +[Profiles] +logged_profile_slot_0_xuid = "" +logged_profile_slot_1_xuid = "" +logged_profile_slot_2_xuid = "" +logged_profile_slot_3_xuid = "" + +[SDL] +mappings_file = "gamecontrollerdb.txt" + +[Storage] +cache_root = "" +content_root = "" +force_mount_devkit = false +mount_cache = true +mount_memory_unit = false +mount_scratch = false +storage_root = "" + +[UI] +custom_font_path = "" +font_size = 14 +headless = false +imgui_debug = false +profiler_dpi_scaling = false +show_achievement_notification = false +show_profiler = false +storage_selection_dialog = false +window_size_x = 1280 +window_size_y = 720 + +[Video] +avpack = 8 +custom_internal_display_resolution_x = 0 +custom_internal_display_resolution_y = 0 +enable_3d_mode = false +interlaced = false + +[Vulkan] +vulkan_allow_present_mode_fifo_relaxed = true +vulkan_allow_present_mode_immediate = true +vulkan_allow_present_mode_mailbox = true +vulkan_device = -1 +vulkan_log_debug_messages = true +vulkan_pipeline_creation_threads = -1 +vulkan_semaphore_reuse_workaround = false +vulkan_sparse_shared_memory = true +vulkan_validation = false + +[Win32] +win32_high_resolution_timer = true +win32_mmcss = true + +[x64] +align_all_basic_blocks = 0 +delay_via_maybeyield = false +enable_host_guest_stack_synchronization = true +enable_incorrect_roundingmode_behavior = false +enable_rmw_context_merging = false +instrument_call_times = false +max_stackpoints = 65536 +x64_extension_mask = -1 +xop_arithmetic_right_shifts = false +xop_compares = true +xop_left_shifts = false +xop_right_shifts = false +xop_rotates = false +----------- END OF CONFIG DUMP ---- +i> 000000D8 Loaded config: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\xenia-canary.config.toml +i> 000000D8 Content root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\content +i> 000000D8 Host cache root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\cache_host +w> 000000D8 Unable to load Japanese font; JP characters will be boxes +w> 000000D8 Unable to load Japanese font; JP characters will be boxes +i> 00000128 Setup: Initializing Memory... +i> 00000128 Setup: Initializing Exports... +i> 00000128 Setup: Initializing Processor... +i> 00000128 Setup: Initializing Audio... +i> 00000128 Setup: Initializing Graphics... +i> 00000128 Setup: Initializing HID... +i> 00000128 winkey: "0x08" binds key 0x8 to controller input GUIDE. +i> 00000128 winkey: "^A" binds key 0x41 to controller input DPAD_LEFT. +i> 00000128 winkey: "^D" binds key 0x44 to controller input DPAD_RIGHT. +i> 00000128 winkey: "^S" binds key 0x53 to controller input DPAD_DOWN. +i> 00000128 winkey: "^W" binds key 0x57 to controller input DPAD_UP. +i> 00000128 winkey: "_A" binds key 0x41 to controller input LEFT_THUMB_LEFT. +i> 00000128 winkey: "_D" binds key 0x44 to controller input LEFT_THUMB_RIGHT. +i> 00000128 winkey: "_S" binds key 0x53 to controller input LEFT_THUMB_DOWN. +i> 00000128 winkey: "_W" binds key 0x57 to controller input LEFT_THUMB_UP. +i> 00000128 winkey: "F" binds key 0x46 to controller input LEFT_THUMB_PRESSED. +i> 00000128 winkey: "0x26" binds key 0x26 to controller input RIGHT_THUMB_UP. +i> 00000128 winkey: "0x28" binds key 0x28 to controller input RIGHT_THUMB_DOWN. +i> 00000128 winkey: "0x27" binds key 0x27 to controller input RIGHT_THUMB_RIGHT. +i> 00000128 winkey: "0x25" binds key 0x25 to controller input RIGHT_THUMB_LEFT. +i> 00000128 winkey: "K" binds key 0x4B to controller input RIGHT_THUMB_PRESSED. +i> 00000128 winkey: "L" binds key 0x4C to controller input X. +i> 00000128 winkey: "0xDE" binds key 0xDE to controller input B. +i> 00000128 winkey: "0xBA" binds key 0xBA to controller input A. +i> 00000128 winkey: "P" binds key 0x50 to controller input Y. +i> 00000128 winkey: "Q" binds key 0x51 to controller input LEFT_TRIGGER. +i> 00000128 winkey: "I" binds key 0x49 to controller input LEFT_TRIGGER. +i> 00000128 winkey: "E" binds key 0x45 to controller input RIGHT_TRIGGER. +i> 00000128 winkey: "O" binds key 0x4F to controller input RIGHT_TRIGGER. +i> 00000128 winkey: "Z" binds key 0x5A to controller input BACK. +i> 00000128 winkey: "X" binds key 0x58 to controller input START. +i> 00000128 winkey: "1" binds key 0x31 to controller input LEFT_SHOULDER. +i> 00000128 winkey: "3" binds key 0x33 to controller input RIGHT_SHOULDER. +i> 000000D8 SDL Version 2.32.2 initialized. +w> 000000D8 SDL GameControllerDB: file 'gamecontrollerdb.txt' does not exist. +i> 00000128 Setup: Initializing VFS... +i> 00000128 PatchDB: Loaded patches for 0 titles +i> 00000128 Setup: Initializing Kernel... +i> 00000128 ProfileManager: Found 0 Profiles +w> 00000128 BaseHeap::AllocFixed attempting commit on unreserved page +w> 00000128 BaseHeap::AllocFixed attempting commit on unreserved page +i> 00000128 Setup: Starting graphics_system... +i> 00000128 DXGI adapter: NVIDIA GeForce GTX 1070 Ti (vendor 0x1002, device 0x73DF) +i> 00000128 Direct3D 12 device and OS features: +* Max GPU virtual address bits per resource: 40 +* Non-zeroed heap creation: yes +* Pixel-shader-specified stencil reference: no +* Programmable sample positions: tier 0 +* Rasterizer-ordered views: yes +* Resource binding: tier 3 +* Tiled resources: tier 4 +* Unaligned block-compressed textures: yes +i> 00000128 XThread01000010 (1) Stack: 70010000-70030000 +i> 00000128 XThread01000014 (2) Stack: 70050000-70070000 +i> 00000128 Setup: Starting audio_system... +K> 01000010 XThread::Execute thid 1 (handle=01000010, 'GPU Commands (01000010)', native=00000158, ) +K> 01000014 XThread::Execute thid 2 (handle=01000014, 'GPU Frame limiter (01000014)', native=0000015C, ) +i> 00000128 XThread01000018 (3) Stack: 70090000-700B0000 +i> 00000128 XThread0100001C (4) Stack: 700D0000-700F0000 +K> 01000018 XThread::Execute thid 3 (handle=01000018, 'XMA Decoder (01000018)', native=00000184, ) +K> 0100001C XThread::Execute thid 4 (handle=0100001C, 'Audio Worker (0100001C)', native=00000188, ) +i> 000000D8 Checking for XISO +F> 000000D8 DiscImageDevice::Initialize +i> 000000D8 Checking for XISO +F> 000000D8 DiscImageDevice::Initialize +F> 000000D8 DiscImageDevice::Initialize +i> 000000D8 Loading module GAME:\default.xex +F> 000000D8 DiscImageDevice::ResolvePath(\default.xex) +i> 000000D8 Module \Device\Cdrom0\default.xex: +Module Hash: CCF935D24A74E002 + Module Flags: 00000001 + XEX_MODULE_TITLE +Security Header: + Image Flags: 00000008 + XEX_IMAGE_XGD2_MEDIA_ONLY + Load Address: 82000000 + Image Size: 00920000 + Export Table: 00000000 +Optional Header Count: 15 + XEX_HEADER_RESOURCE_INFO: + 535107D4 828FB900-8291D8CF, 139215b + XEX_HEADER_FILE_FORMAT_INFO: + Info Size: 36 + Encryption Type: Normal + Compression Type: Normal + Window Size: 32768 + Block Size: 61440 + Block Hash: B3 2B D7 D4 EF 96 9A C5 9F D7 77 C6 8A 99 AA 1C BD 87 1C BE 00 90 2E F1 46 3F A3 D7 00 00 00 10 + XEX_HEADER_ENTRY_POINT: 824AB748 + XEX_HEADER_IMAGE_BASE_ADDRESS: 82000000 + XEX_HEADER_IMPORT_LIBRARIES: + xam.xex - 104 imports + Version: 2.0.4552.0 + Min Version: 2.0.4552.0 + xboxkrnl.exe - 294 imports + Version: 2.0.4552.0 + Min Version: 2.0.4552.0 + XEX_HEADER_CHECKSUM_TIMESTAMP: + Checksum : 00902EF1 + Time Stamp: 463FA3D7 - Tue May 8 00:10:31 2007 + XEX_HEADER_ORIGINAL_PE_NAME: default.pe + XEX_HEADER_STATIC_LIBRARIES: + XAPILIB : 2.0.3215.0 + D3D9 : 2.0.3215.1 + D3DX9 : 2.0.3215.0 + XBOXKRNL : 2.0.3215.0 + XAUD : 2.0.3215.0 + LIBCPMT : 2.0.3215.0 + XMP : 2.0.3215.0 + XMEDIA : 2.0.3215.0 + XONLINE : 2.0.3215.0 + XGRAPHC : 2.0.3215.0 + X3DAUD : 2.0.3215.1 + XACT : 2.0.3215.1 + XEX_HEADER_TLS_INFO: + Slot Count: 64 + Raw Data Address: 00000000 + Data Size: 0 + Raw Data Size: 0 + XEX_HEADER_DEFAULT_STACK_SIZE: 524288 + XEX_HEADER_SYSTEM_FLAGS: 00000400 + XEX_SYSTEM_PAL50_INCOMPATIBLE + XEX_HEADER_EXECUTION_INFO: + Media ID: 2D2E2EEB + Title ID: 535107D4 + Savegame ID: 535107D4 + Disc Number / Total: 1 / 1 + XEX_HEADER_GAME_RATINGS: + ESRB: Teen + PEGI: 12+ + PEGI-FI: 11+ + PEGI - PT: 12+ + BBFC: 12+ + CERO: Unrated + USK: Approved for children aged 12 and above + OFLC - AU: Parental Guidance + OFLC - NZ: Parental Guidance + KMRB: Unrated + Brazil: Unrated + FPB: 13+ + XEX_HEADER_LAN_KEY: E0 3C EA 47 3C AE 06 62 98 8F DB 7F 58 50 12 38 + XEX_HEADER_XBOX360_LOGO: + Section Size: 1736 + Logo Size: 1728 +Sections: + 0 RODATA 1 pages 82000000 - 82010000 (65536 bytes) + 1 RODATA 1 pages 82010000 - 82020000 (65536 bytes) + 2 RODATA 1 pages 82020000 - 82030000 (65536 bytes) + 3 RODATA 1 pages 82030000 - 82040000 (65536 bytes) + 4 RODATA 1 pages 82040000 - 82050000 (65536 bytes) + 5 RODATA 1 pages 82050000 - 82060000 (65536 bytes) + 6 RODATA 1 pages 82060000 - 82070000 (65536 bytes) + 7 RODATA 1 pages 82070000 - 82080000 (65536 bytes) + 8 RODATA 1 pages 82080000 - 82090000 (65536 bytes) + 9 RODATA 1 pages 82090000 - 820A0000 (65536 bytes) + 10 RODATA 1 pages 820A0000 - 820B0000 (65536 bytes) + 11 RODATA 1 pages 820B0000 - 820C0000 (65536 bytes) + 12 RODATA 1 pages 820C0000 - 820D0000 (65536 bytes) + 13 RODATA 1 pages 820D0000 - 820E0000 (65536 bytes) + 14 RODATA 1 pages 820E0000 - 820F0000 (65536 bytes) + 15 RODATA 1 pages 820F0000 - 82100000 (65536 bytes) + 16 RODATA 1 pages 82100000 - 82110000 (65536 bytes) + 17 RODATA 1 pages 82110000 - 82120000 (65536 bytes) + 18 RODATA 1 pages 82120000 - 82130000 (65536 bytes) + 19 RODATA 1 pages 82130000 - 82140000 (65536 bytes) + 20 RODATA 1 pages 82140000 - 82150000 (65536 bytes) + 21 CODE 1 pages 82150000 - 82160000 (65536 bytes) + 22 CODE 1 pages 82160000 - 82170000 (65536 bytes) + 23 CODE 1 pages 82170000 - 82180000 (65536 bytes) + 24 CODE 1 pages 82180000 - 82190000 (65536 bytes) + 25 CODE 1 pages 82190000 - 821A0000 (65536 bytes) + 26 CODE 1 pages 821A0000 - 821B0000 (65536 bytes) + 27 CODE 1 pages 821B0000 - 821C0000 (65536 bytes) + 28 CODE 1 pages 821C0000 - 821D0000 (65536 bytes) + 29 CODE 1 pages 821D0000 - 821E0000 (65536 bytes) + 30 CODE 1 pages 821E0000 - 821F0000 (65536 bytes) + 31 CODE 1 pages 821F0000 - 82200000 (65536 bytes) + 32 CODE 1 pages 82200000 - 82210000 (65536 bytes) + 33 CODE 1 pages 82210000 - 82220000 (65536 bytes) + 34 CODE 1 pages 82220000 - 82230000 (65536 bytes) + 35 CODE 1 pages 82230000 - 82240000 (65536 bytes) + 36 CODE 1 pages 82240000 - 82250000 (65536 bytes) + 37 CODE 1 pages 82250000 - 82260000 (65536 bytes) + 38 CODE 1 pages 82260000 - 82270000 (65536 bytes) + 39 CODE 1 pages 82270000 - 82280000 (65536 bytes) + 40 CODE 1 pages 82280000 - 82290000 (65536 bytes) + 41 CODE 1 pages 82290000 - 822A0000 (65536 bytes) + 42 CODE 1 pages 822A0000 - 822B0000 (65536 bytes) + 43 CODE 1 pages 822B0000 - 822C0000 (65536 bytes) + 44 CODE 1 pages 822C0000 - 822D0000 (65536 bytes) + 45 CODE 1 pages 822D0000 - 822E0000 (65536 bytes) + 46 CODE 1 pages 822E0000 - 822F0000 (65536 bytes) + 47 CODE 1 pages 822F0000 - 82300000 (65536 bytes) + 48 CODE 1 pages 82300000 - 82310000 (65536 bytes) + 49 CODE 1 pages 82310000 - 82320000 (65536 bytes) + 50 CODE 1 pages 82320000 - 82330000 (65536 bytes) + 51 CODE 1 pages 82330000 - 82340000 (65536 bytes) + 52 CODE 1 pages 82340000 - 82350000 (65536 bytes) + 53 CODE 1 pages 82350000 - 82360000 (65536 bytes) + 54 CODE 1 pages 82360000 - 82370000 (65536 bytes) + 55 CODE 1 pages 82370000 - 82380000 (65536 bytes) + 56 CODE 1 pages 82380000 - 82390000 (65536 bytes) + 57 CODE 1 pages 82390000 - 823A0000 (65536 bytes) + 58 CODE 1 pages 823A0000 - 823B0000 (65536 bytes) + 59 CODE 1 pages 823B0000 - 823C0000 (65536 bytes) + 60 CODE 1 pages 823C0000 - 823D0000 (65536 bytes) + 61 CODE 1 pages 823D0000 - 823E0000 (65536 bytes) + 62 CODE 1 pages 823E0000 - 823F0000 (65536 bytes) + 63 CODE 1 pages 823F0000 - 82400000 (65536 bytes) + 64 CODE 1 pages 82400000 - 82410000 (65536 bytes) + 65 CODE 1 pages 82410000 - 82420000 (65536 bytes) + 66 CODE 1 pages 82420000 - 82430000 (65536 bytes) + 67 CODE 1 pages 82430000 - 82440000 (65536 bytes) + 68 CODE 1 pages 82440000 - 82450000 (65536 bytes) + 69 CODE 1 pages 82450000 - 82460000 (65536 bytes) + 70 CODE 1 pages 82460000 - 82470000 (65536 bytes) + 71 CODE 1 pages 82470000 - 82480000 (65536 bytes) + 72 CODE 1 pages 82480000 - 82490000 (65536 bytes) + 73 CODE 1 pages 82490000 - 824A0000 (65536 bytes) + 74 CODE 1 pages 824A0000 - 824B0000 (65536 bytes) + 75 CODE 1 pages 824B0000 - 824C0000 (65536 bytes) + 76 CODE 1 pages 824C0000 - 824D0000 (65536 bytes) + 77 CODE 1 pages 824D0000 - 824E0000 (65536 bytes) + 78 CODE 1 pages 824E0000 - 824F0000 (65536 bytes) + 79 CODE 1 pages 824F0000 - 82500000 (65536 bytes) + 80 CODE 1 pages 82500000 - 82510000 (65536 bytes) + 81 CODE 1 pages 82510000 - 82520000 (65536 bytes) + 82 CODE 1 pages 82520000 - 82530000 (65536 bytes) + 83 CODE 1 pages 82530000 - 82540000 (65536 bytes) + 84 CODE 1 pages 82540000 - 82550000 (65536 bytes) + 85 CODE 1 pages 82550000 - 82560000 (65536 bytes) + 86 CODE 1 pages 82560000 - 82570000 (65536 bytes) + 87 CODE 1 pages 82570000 - 82580000 (65536 bytes) + 88 CODE 1 pages 82580000 - 82590000 (65536 bytes) + 89 CODE 1 pages 82590000 - 825A0000 (65536 bytes) + 90 CODE 1 pages 825A0000 - 825B0000 (65536 bytes) + 91 CODE 1 pages 825B0000 - 825C0000 (65536 bytes) + 92 CODE 1 pages 825C0000 - 825D0000 (65536 bytes) + 93 CODE 1 pages 825D0000 - 825E0000 (65536 bytes) + 94 CODE 1 pages 825E0000 - 825F0000 (65536 bytes) + 95 CODE 1 pages 825F0000 - 82600000 (65536 bytes) + 96 CODE 1 pages 82600000 - 82610000 (65536 bytes) + 97 CODE 1 pages 82610000 - 82620000 (65536 bytes) + 98 CODE 1 pages 82620000 - 82630000 (65536 bytes) + 99 CODE 1 pages 82630000 - 82640000 (65536 bytes) + 100 CODE 1 pages 82640000 - 82650000 (65536 bytes) + 101 CODE 1 pages 82650000 - 82660000 (65536 bytes) + 102 CODE 1 pages 82660000 - 82670000 (65536 bytes) + 103 CODE 1 pages 82670000 - 82680000 (65536 bytes) + 104 CODE 1 pages 82680000 - 82690000 (65536 bytes) + 105 CODE 1 pages 82690000 - 826A0000 (65536 bytes) + 106 CODE 1 pages 826A0000 - 826B0000 (65536 bytes) + 107 CODE 1 pages 826B0000 - 826C0000 (65536 bytes) + 108 CODE 1 pages 826C0000 - 826D0000 (65536 bytes) + 109 CODE 1 pages 826D0000 - 826E0000 (65536 bytes) + 110 CODE 1 pages 826E0000 - 826F0000 (65536 bytes) + 111 CODE 1 pages 826F0000 - 82700000 (65536 bytes) + 112 CODE 1 pages 82700000 - 82710000 (65536 bytes) + 113 CODE 1 pages 82710000 - 82720000 (65536 bytes) + 114 CODE 1 pages 82720000 - 82730000 (65536 bytes) + 115 CODE 1 pages 82730000 - 82740000 (65536 bytes) + 116 CODE 1 pages 82740000 - 82750000 (65536 bytes) + 117 CODE 1 pages 82750000 - 82760000 (65536 bytes) + 118 CODE 1 pages 82760000 - 82770000 (65536 bytes) + 119 CODE 1 pages 82770000 - 82780000 (65536 bytes) + 120 CODE 1 pages 82780000 - 82790000 (65536 bytes) + 121 CODE 1 pages 82790000 - 827A0000 (65536 bytes) + 122 CODE 1 pages 827A0000 - 827B0000 (65536 bytes) + 123 CODE 1 pages 827B0000 - 827C0000 (65536 bytes) + 124 CODE 1 pages 827C0000 - 827D0000 (65536 bytes) + 125 CODE 1 pages 827D0000 - 827E0000 (65536 bytes) + 126 CODE 1 pages 827E0000 - 827F0000 (65536 bytes) + 127 CODE 1 pages 827F0000 - 82800000 (65536 bytes) + 128 CODE 1 pages 82800000 - 82810000 (65536 bytes) + 129 CODE 1 pages 82810000 - 82820000 (65536 bytes) + 130 CODE 1 pages 82820000 - 82830000 (65536 bytes) + 131 CODE 1 pages 82830000 - 82840000 (65536 bytes) + 132 CODE 1 pages 82840000 - 82850000 (65536 bytes) + 133 CODE 1 pages 82850000 - 82860000 (65536 bytes) + 134 CODE 1 pages 82860000 - 82870000 (65536 bytes) + 135 RWDATA 1 pages 82870000 - 82880000 (65536 bytes) + 136 RWDATA 1 pages 82880000 - 82890000 (65536 bytes) + 137 RWDATA 1 pages 82890000 - 828A0000 (65536 bytes) + 138 RWDATA 1 pages 828A0000 - 828B0000 (65536 bytes) + 139 RWDATA 1 pages 828B0000 - 828C0000 (65536 bytes) + 140 RWDATA 1 pages 828C0000 - 828D0000 (65536 bytes) + 141 RWDATA 1 pages 828D0000 - 828E0000 (65536 bytes) + 142 RWDATA 1 pages 828E0000 - 828F0000 (65536 bytes) + 143 RWDATA 1 pages 828F0000 - 82900000 (65536 bytes) + 144 RWDATA 1 pages 82900000 - 82910000 (65536 bytes) + 145 RWDATA 1 pages 82910000 - 82920000 (65536 bytes) +Imports: + xam - 52 imports + Version: 0.0.4552.32 + Min Version: 0.0.4552.32 + + Total: 52 + Known: 100% (52 known, 0 unknown) + Implemented: 98% (51 implemented, 1 unimplemented) + + F 82000600 8284DA7C 28C ( 652) XNotifyPositionUI + F 82000604 8284DA8C 2BC ( 700) XamShowSigninUI + F 82000608 8284DA9C 2C1 ( 705) XamShowKeyboardUI + F 8200060C 8284DAAC 2D5 ( 725) !! XamShowGamerCardUIForXUID + F 82000610 8284DABC 2CB ( 715) XamShowDeviceSelectorUI + F 82000614 8284DACC 2D9 ( 729) XamShowDirtyDiscErrorUI + F 82000618 8284DADC 1B3 ( 435) XamTaskShouldExit + F 8200061C 8284DAEC 1B1 ( 433) XamTaskCloseHandle + F 82000620 8284DAFC 1AF ( 431) XamTaskSchedule + F 82000624 8284DB0C 1A4 ( 420) XamLoaderLaunchTitle + F 82000628 8284DB1C 1F7 ( 503) XMsgStartIORequest + F 8200062C 8284DB2C 20E ( 526) XamUserGetName + F 82000630 8284DB3C 210 ( 528) XamUserGetSigninState + F 82000634 8284DB4C 282 ( 642) XamGetSystemVersion + F 82000638 8284DB5C 2F7 ( 759) XamUserCreateStatsEnumerator + F 8200063C 8284DB6C 2EE ( 750) XamUserCreateAchievementEnumerator + F 82000640 8284DB7C 20A ( 522) XamUserGetXUID + F 82000644 8284DB8C 250 ( 592) XamEnumerate + F 82000648 8284DB9C 3CC ( 972) XGetGameRegion + F 8200064C 8284DBAC 190 ( 400) XamInputGetCapabilities + F 82000650 8284DBBC 191 ( 401) XamInputGetState + F 82000654 8284DBCC 192 ( 402) XamInputSetState + F 82000658 8284DBDC 198 ( 408) XamInputGetKeystrokeEx + F 8200065C 8284DBEC 258 ( 600) XamContentCreate + F 82000660 8284DBFC 25B ( 603) XamContentDelete + F 82000664 8284DC0C 25A ( 602) XamContentClose + F 82000668 8284DC1C 260 ( 608) XamContentSetThumbnail + F 8200066C 8284DC2C 262 ( 610) XamContentGetCreator + F 82000670 8284DC3C 25C ( 604) XamContentCreateEnumerator + F 82000674 8284DC4C 265 ( 613) XamContentGetDeviceState + F 82000678 8284DC5C 25E ( 606) XamContentGetDeviceData + F 8200067C 8284DC6C 25F ( 607) XamContentGetDeviceName + F 82000680 8284DC7C 1A0 ( 416) XamEnableInactivityProcessing + F 82000684 8284DC8C 1A1 ( 417) XamResetInactivity + F 82000688 8284DC9C 2DC ( 732) XamShowMessageBoxUIEx + F 8200068C 8284DCAC 3CD ( 973) XGetLanguage + F 82000690 8284DCBC 3CB ( 971) XGetAVPack + F 82000694 8284DCCC 1A9 ( 425) XamLoaderTerminateTitle + F 82000698 8284DCDC 280 ( 640) XamGetExecutionId + F 8200069C 8284E45C 28B ( 651) XNotifyGetNext + F 820006A0 8284E44C 002 ( 2) NetDll_WSACleanup + F 820006A4 8284E43C 001 ( 1) NetDll_WSAStartup + F 820006A8 8284E46C 28A ( 650) XamNotifyCreateListener + F 820006AC 8284E42C 316 ( 790) XamSessionCreateHandle + F 820006B0 8284E41C 317 ( 791) XamSessionRefObjByHandle + F 820006B4 8284E40C 21A ( 538) XamUserWriteProfileSettings + F 820006B8 8284E3FC 219 ( 537) XamUserReadProfileSettings + F 820006BC 8284E3EC 1EA ( 490) XamAlloc + F 820006C0 8284E3DC 1EC ( 492) XamFree + F 820006C4 8284E3CC 3D1 ( 977) XGetVideoMode + F 820006C8 8284E3BC 1F4 ( 500) XMsgInProcessCall + F 820006CC 8284E3AC 1FC ( 508) XMsgStartIORequestEx + + xboxkrnl - 152 imports + Version: 0.0.4552.32 + Min Version: 0.0.4552.32 + + Total: 152 + Known: 100% (152 known, 0 unknown) + Implemented: 95% (145 implemented, 7 unimplemented) + + F 820006D4 8284E1FC 0B4 ( 180) KfReleaseSpinLock + F 820006D8 8284E20C 0B1 ( 177) KfAcquireSpinLock + F 820006DC 8284E21C 1DF ( 479) KiApcNormalRoutineNop + F 820006E0 8284E22C 1B6 ( 438) VdEnableRingBufferRPtrWriteBack + F 820006E4 8284E23C 1C3 ( 451) VdInitializeRingBuffer + F 820006E8 8284E24C 0BE ( 190) MmGetPhysicalAddress + F 820006EC 8284E25C 1D9 ( 473) VdSetSystemCommandBufferGpuIdentifierAddress + F 820006F0 8284E26C 13B ( 315) sprintf + F 820006F4 8284E27C 1B9 ( 441) VdGetCurrentDisplayGamma + V 820006F8 266 ( 614) KeCertMonitorData + F 820006FC 8284E28C 14D ( 333) _vsnprintf + V 82000700 158 ( 344) XboxKrnlVersion + F 82000704 8284E29C 1DC ( 476) VdShutdownEngines + F 82000708 8284E2AC 1CA ( 458) VdQueryVideoMode + F 8200070C 8284E2BC 1BA ( 442) VdGetCurrentDisplayInformation + F 82000710 8284E2CC 1D3 ( 467) VdSetDisplayMode + F 82000714 8284E2DC 1D5 ( 469) VdSetGraphicsInterruptCallback + F 82000718 8284E2EC 1C2 ( 450) VdInitializeEngines + F 8200071C 8284E2FC 1C6 ( 454) VdIsHSIOTrainingSucceeded + F 82000720 8284E30C 1C9 ( 457) VdQueryVideoFlags + F 82000724 8284E31C 1B1 ( 433) VdCallGraphicsNotificationRoutines + V 82000728 1C0 ( 448) VdGpuClockInMHz + F 8200072C 8284E32C 1C5 ( 453) VdInitializeScalerCommandBuffer + F 82000730 8284E33C 269 ( 617) VdRetrainEDRAM + F 82000734 8284E34C 26A ( 618) VdRetrainEDRAMWorker + V 82000738 1C1 ( 449) VdHSIOCalibrationLock + F 8200073C 8284E35C 06B ( 107) KeLockL2 + F 82000740 8284E36C 06C ( 108) KeUnlockL2 + F 82000744 8284E37C 1C7 ( 455) VdPersistDisplay + F 82000748 8284E38C 25B ( 603) VdSwap + F 8200074C 8284E39C 1BD ( 445) VdGetSystemCommandBuffer + V 82000750 1BE ( 446) VdGlobalDevice + F 82000754 8284E1EC 04D ( 77) KeAcquireSpinLockAtRaisedIrql + F 82000758 8284E1DC 089 ( 137) KeReleaseSpinLockFromRaisedIrql + F 8200075C 8284E1CC 1B4 ( 436) VdEnableDisableClockGating + F 82000760 8284E1BC 13F ( 319) RtlTimeFieldsToTime + F 82000764 8284E1AC 136 ( 310) RtlRaiseException + F 82000768 8284E19C 0EE ( 238) NtQueryVirtualMemory + F 8200076C 8284E18C 11B ( 283) RtlCompareMemoryUlong + F 82000770 8284E17C 066 ( 102) KeGetCurrentProcessType + F 82000774 8284E16C 053 ( 83) KeBugCheckEx + F 82000778 8284E15C 126 ( 294) RtlFillMemoryUlong + V 8200077C 1AE ( 430) ExLoadedCommandLine + F 82000780 8284E14C 05A ( 90) KeDelayExecutionThread + F 82000784 8284E13C 143 ( 323) RtlUnicodeToMultiByteN + F 82000788 8284E12C 0E4 ( 228) NtQueryDirectoryFile + F 8200078C 8284E10C 019 ( 25) ExTerminateThread + F 82000790 8284E0FC 09B ( 155) KeSetCurrentStackPointers + F 82000794 8284E0EC 197 ( 407) XexGetProcedureAddress + F 82000798 8284E0DC 03C ( 60) !! IoDismountVolumeByFileHandle + F 8200079C 8284E0CC 0D9 ( 217) NtDeviceIoControlFile + F 820007A0 8284E0BC 028 ( 40) HalReturnToFirmware + F 820007A4 8284E0AC 003 ( 3) DbgPrint + F 820007A8 8284E09C 140 ( 320) RtlTimeToTimeFields + F 820007AC 8284E08C 0FE ( 254) NtWaitForMultipleObjectsEx + F 820007B0 8284E07C 0F3 ( 243) NtReleaseSemaphore + F 820007B4 8284E06C 0D5 ( 213) NtCreateSemaphore + F 820007B8 8284E05C 084 ( 132) KeQuerySystemTime + F 820007BC 8284E04C 0E8 ( 232) NtQueryInformationFile + F 820007C0 8284E03C 0F7 ( 247) NtSetInformationFile + F 820007C4 8284E02C 0FD ( 253) NtWaitForSingleObjectEx + F 820007C8 8284E01C 0CE ( 206) NtClearEvent + F 820007CC 8284E00C 0F5 ( 245) NtResumeThread + V 820007D0 0AD ( 173) KeTimeStampBundle + F 820007D4 8284DFFC 010 ( 16) ExGetXConfigSetting + V 820007D8 059 ( 89) KeDebugMonitorData + F 820007DC 8284DFEC 097 ( 151) KeSetAffinityThread + F 820007E0 8284DFDC 0FC ( 252) NtSuspendThread + F 820007E4 8284DFCC 081 ( 129) KeQueryBasePriorityThread + V 820007E8 01B ( 27) ExThreadObjectType + F 820007EC 8284DFBC 110 ( 272) ObReferenceObjectByHandle + F 820007F0 8284DFAC 099 ( 153) KeSetBasePriorityThread + F 820007F4 8284DF9C 10B ( 267) ObLookupThreadByThreadId + F 820007F8 8284DF8C 10E ( 270) ObOpenObjectByPointer + F 820007FC 8284DF7C 0DA ( 218) NtDuplicateObject + F 82000800 8284DF6C 101 ( 257) NtYieldExecution + F 82000804 8284DF5C 0F6 ( 246) NtSetEvent + F 82000808 8284DF4C 052 ( 82) KeBugCheck + F 8200080C 8284DF3C 0BC ( 188) MmDeleteKernelStack + F 82000810 8284DF2C 0BB ( 187) MmCreateKernelStack + F 82000814 8284DF1C 0D1 ( 209) NtCreateEvent + F 82000818 8284DF0C 135 ( 309) RtlNtStatusToDosError + F 8200081C 8284DEFC 194 ( 404) XexCheckExecutablePrivilege + F 82000820 8284DEEC 05F ( 95) KeEnterCriticalRegion + F 82000824 8284DEDC 07D ( 125) KeLeaveCriticalRegion + F 82000828 8284DECC 0CC ( 204) NtAllocateVirtualMemory + F 8200082C 8284DEBC 259 ( 601) !! StfsCreateDevice + F 82000830 8284DEAC 103 ( 259) ObCreateSymbolicLink + F 82000834 8284DE9C 25A ( 602) !! StfsControlDevice + F 82000838 8284DE8C 0DB ( 219) NtFlushBuffersFile + F 8200083C 8284DE7C 104 ( 260) ObDeleteSymbolicLink + F 82000840 8284DE6C 105 ( 261) ObDereferenceObject + F 82000844 8284DE5C 0DC ( 220) NtFreeVirtualMemory + F 82000848 8284DE4C 0D2 ( 210) NtCreateFile + F 8200084C 8284DE3C 256 ( 598) XeKeysConsolePrivateKeySign + F 82000850 8284DE2C 0F0 ( 240) NtReadFile + F 82000854 8284DE1C 0FF ( 255) NtWriteFile + F 82000858 8284DE0C 192 ( 402) XeCryptSha + F 8200085C 8284DDFC 257 ( 599) !! XeKeysConsoleSignatureVerification + F 82000860 8284DDEC 015 ( 21) ExRegisterTitleTerminateNotification + F 82000864 8284DDDC 09D ( 157) KeSetEvent + F 82000868 8284DDCC 0B0 ( 176) KeWaitForSingleObject + F 8200086C 8284DDBC 08F ( 143) KeResetEvent + V 82000870 193 ( 403) XexExecutableModuleHandle + F 82000874 8284DDAC 12B ( 299) RtlImageXexHeaderField + F 82000878 8284DD9C 1A5 ( 421) !! __C_specific_handler + F 8200087C 8284DD8C 12C ( 300) RtlInitAnsiString + F 82000880 8284DD7C 0DF ( 223) NtOpenFile + F 82000884 8284DD6C 0CF ( 207) NtClose + F 82000888 8284DD5C 0EF ( 239) NtQueryVolumeInformationFile + F 8200088C 8284DD4C 0C4 ( 196) MmQueryAddressProtect + F 82000890 8284DD3C 0BD ( 189) MmFreePhysicalMemory + F 82000894 8284DD2C 0BA ( 186) MmAllocatePhysicalMemoryEx + F 82000898 8284DD1C 12E ( 302) RtlInitializeCriticalSection + F 8200089C 8284DD0C 130 ( 304) RtlLeaveCriticalSection + F 820008A0 8284DCFC 125 ( 293) RtlEnterCriticalSection + F 820008A4 8284DCEC 12F ( 303) RtlInitializeCriticalSectionAndSpinCount + F 820008A8 8284E11C 00D ( 13) ExCreateThread + F 820008AC 8284E47C 085 ( 133) KeRaiseIrqlToDpcLevel + F 820008B0 8284E48C 0B3 ( 179) KfLowerIrql + F 820008B4 8284E49C 088 ( 136) KeReleaseSemaphore + F 820008B8 8284E4AC 1F8 ( 504) XAudioGetVoiceCategoryVolume + F 820008BC 8284E4BC 1F7 ( 503) XAudioGetVoiceCategoryVolumeChangeMask + F 820008C0 8284E4CC 0AF ( 175) KeWaitForMultipleObjects + F 820008C4 8284E4DC 092 ( 146) KeResumeThread + F 820008C8 8284E4EC 074 ( 116) KeInitializeSemaphore + F 820008CC 8284E4FC 226 ( 550) XMAReleaseContext + F 820008D0 8284E50C 224 ( 548) XMACreateContext + F 820008D4 8284E51C 083 ( 131) KeQueryPerformanceFrequency + F 820008D8 8284E52C 141 ( 321) RtlTryEnterCriticalSection + F 820008DC 8284E53C 0AE ( 174) KeTryToAcquireSpinLockAtRaisedIrql + F 820008E0 8284E54C 1F3 ( 499) XAudioRegisterRenderDriverClient + F 820008E4 8284E55C 1F4 ( 500) XAudioUnregisterRenderDriverClient + F 820008E8 8284E56C 1F5 ( 501) XAudioSubmitRenderDriverFrame + F 820008EC 8284E57C 195 ( 405) XexGetModuleHandle + F 820008F0 8284E58C 147 ( 327) !! RtlUnwind + F 820008F4 8284E59C 152 ( 338) KeTlsAlloc + F 820008F8 8284E5AC 154 ( 340) KeTlsGetValue + F 820008FC 8284E5BC 155 ( 341) KeTlsSetValue + F 82000900 8284E5CC 153 ( 339) KeTlsFree + F 82000904 8284E5DC 119 ( 281) !! RtlCaptureContext + F 82000908 8284E5EC 05D ( 93) KeEnableFpuExceptions + F 8200090C 8284E5FC 0C6 ( 198) MmQueryStatistics + F 82000910 8284E60C 0D7 ( 215) NtCreateTimer + F 82000914 8284E61C 0FA ( 250) NtSetTimerEx + F 82000918 8284E62C 0CD ( 205) NtCancelTimer + F 8200091C 8284E63C 0E7 ( 231) NtQueryFullAttributesFile + F 82000920 8284E64C 127 ( 295) RtlFreeAnsiString + F 82000924 8284E65C 142 ( 322) RtlUnicodeStringToAnsiString + F 82000928 8284E66C 12D ( 301) RtlInitUnicodeString + F 8200092C 8284E67C 133 ( 307) RtlMultiByteToUnicodeN + F 82000930 8284E68C 001 ( 1) DbgBreakPoint + +w> 000000D8 GameDatabase: Title doesn't contain XLAST data! Multiplayer functionality might be limited. +i> 000000D8 Title name: PROJECT SYLPHEED +i> 000000D8 +-------------------- ACHIEVEMENTS -------------------- ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| ID | Title | Description | Type | Gamerscore | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 1 | Space Combat Award | Received after your first space battle in the Glasner Training Area. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 2 | Schlos Base Defense Award | Received for stopping the missile attack on Schlos Base. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 3 | Aegis of the People Medal | Received for escorting all 7 refugee ships to safety. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 4 | TCAF Luna Medal | Received for bravely helping the fleet escape during the invasion of the Matisse System. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 5 | TCAF Mars Medal | Received for bravery beyond the call of duty during the escape from the Matisse System. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 6 | Soldier's Charm Amulet | Given to you by Raymond as a token of his trust. | Event | 50 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 7 | White Griffons Patch | Received by the commander and pilots of the White Griffon Squadron when it is formed. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 8 | TCAF Jupiter Medal | Received for bravery during the enemy's attack on the Alberti System. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 9 | Furious Pursuit Badge | Received for continuing attacks on the enemy and shooting down a large number of ships. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 10 | Solo Aerospace Combat Award | Received for descending into Acheron's atmosphere and engaging in combat alone. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 11 | Operation Nebula Blaze Award | Received for completing the extremely hazardous Operation Nebula Blaze. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 12 | Guilty Roses Patch | Received for repelling the Guilty Roses Squadron. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 13 | Super Battleship Slayer Patch | Received for shooting down the second S battleship. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 14 | TCAF Terra Medal | Received for shielding the fleet and seeing that all ships safely fled the Ingres System. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 15 | Hellfires Patch | Received for repelling the enemy Hellfire Squadron. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 16 | Night Ravens Patch | Received for challenging and eradicating the Night Raven Squadron. | Event | 50 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 17 | Solar System Defense Award | Received for great achievements during the campaign to defend the Solar System. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 18 | Special Operations Medal | Received for heroically destroying the Prometheus Driver. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 19 | 1,000 Units Destroyed Medal | Received for shooting down 1,000 enemy fighters and attackers in combat. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 20 | 10,000 Units Destroyed Medal | Received for shooting down 10,000 enemy fighters and attackers in combat. | Event | 70 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 21 | Ship Hunter Award | Received for shooting down 100 enemy warships in combat. | Event | 50 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 22 | Gigaton Club Patch | Received for shooting down enemy vessels with a total weight of one gigaton. | Event | 70 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 23 | Weapon Lord Patch | Received after you collect all usable equipment for the Delta Saber. | Event | 80 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 24 | TCAF Pilot's Commendation | Commemmorates you as one of the greatest pilots in history. | Event | 100 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +i> 000000D8 +-------------------- PROPERTIES -------------------- ++----------+------------------+-------------+-----------+ +| ID | Name | Matchmaking | Data Size | ++----------+------------------+-------------+-----------+ +| 10000006 | Killed Aircrafts | False | 4 | ++----------+------------------+-------------+-----------+ +| 10000008 | Equipments | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000000A | Clear Time | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000000B | Killed Warships | False | 4 | ++----------+------------------+-------------+-----------+ +| 10008001 | Rank | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000800A | | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000800B | | False | 4 | ++----------+------------------+-------------+-----------+ +| 20000005 | Killed Weight | False | 8 | ++----------+------------------+-------------+-----------+ +| 20000007 | Clear Time | False | 8 | ++----------+------------------+-------------+-----------+ +| 20000009 | Earned Points | False | 8 | ++----------+------------------+-------------+-----------+ +| 40008002 | Gamer Name | False | 2 | ++----------+------------------+-------------+-----------+ +i> 000000D8 +-------------------- CONTEXTS -------------------- ++----------+-------------+-------------+---------------+-----------+ +| ID | Name | Matchmaking | Default Value | Max Value | ++----------+-------------+-------------+---------------+-----------+ +| 00000000 | Game Stage | False | 0 | 28 | ++----------+-------------+-------------+---------------+-----------+ +| 00000001 | Game Status | False | 0 | 9 | ++----------+-------------+-------------+---------------+-----------+ +| 00008001 | | False | 0 | 0 | ++----------+-------------+-------------+---------------+-----------+ +| 0000800A | Game Type | True | 0 | 1 | ++----------+-------------+-------------+---------------+-----------+ +| 0000800B | | True | 0 | 0 | ++----------+-------------+-------------+---------------+-----------+ +i> 000000D8 +-------------------- STATS VIEWS -------------------- ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| ID | View Type | Name | Skilled | Arbitrated | Hidden | Team View | Online Only | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000001 | Leaderboard | Time Attack (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000002 | Leaderboard | Score Attack (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000003 | Leaderboard | Extra 1 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000004 | Leaderboard | Extra 1 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000005 | Leaderboard | Extra 2 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000006 | Leaderboard | Extra 2 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000007 | Leaderboard | Extra 3 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000008 | Leaderboard | Extra 3 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000009 | Leaderboard | Extra 4 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 0000000A | Leaderboard | Extra 4 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 0000000C | Leaderboard | Time Attack (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 0000000D | Leaderboard | Score Attack (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| FFFF0000 | Leaderboard | | True | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +i> 000000D8 +-------------------- PRESENCE MODES -------------------- ++---------------+----------------+------------------+ +| Context Value | Contexts Count | Properties Count | ++---------------+----------------+------------------+ +| 0 | 2 | 0 | ++---------------+----------------+------------------+ +i> 000000D8 XThread01000020 (5) Stack: 70110000-70130000 +i> 000000D8 KernelState: Launching module... +i> 01000010 Loaded 7 shaders from storage +i> 01000010 Loaded 4 pipeline descriptions, 8 shader translations needed +i> 000000D8 XThreadF8000008 (6) Stack: 70150000-701D0000 +K> 01000020 XThread::Execute thid 5 (handle=01000020, 'Kernel Dispatch (01000020)', native=00000194, ) +K> F8000008 XThread::Execute thid 6 (handle=F8000008, 'Main XThread (F8000008)', native=0000019C) +i> 01000010 Translated 7 shaders in 3 ms +i> 01000010 Pipeline cache loaded: 4 created, 0 already exist, 4 total stored +i> 01000010 Pipeline creation took 0 milliseconds +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800000C type=1 initial_state=0 lr=824A9F6C +F> F8000008 NullDevice::ResolvePath() +F> F8000008 NullDevice::ResolvePath() +F> F8000008 NullDevice::ResolvePath() +!> F8000008 undefined extern call to 8284E0DC IoDismountVolumeByFileHandle +F> F8000008 NullDevice::ResolvePath() +i> F8000008 Got xam task args: v1 = 02080002, v2 = 00000000 +i> F8000008 XThreadF8000010 (7) Stack: 701F0000-70270000 +K> F8000010 XThread::Execute thid 7 (handle=F8000010, 'XThread01BC (F8000010)', native=000001BC) +F> F8000010 NullDevice::ResolvePath() +w> F8000010 Game is attempting to allocate devkit debug memory (base: 00000000, size: 000FF000). Ignoring debug flag and using normal allocation. +!> F8000010 undefined extern call to 8284DEBC StfsCreateDevice +K> F8000010 AUDIT-HLC KeSetEvent guest_ptr=8287094C lr=824A95D0 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000020 type=1 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000024 (8) Stack: 70290000-702B0000 +K> F8000024 XThread::Execute thid 8 (handle=F8000024, 'XThread01C0 (F8000024)', native=000001C0) +K> F8000024 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000020 alertable=0 lr=824AC578 guest_lr=824AFFC4 +F> F8000008 HostPathDevice::ResolvePath() +i> F8000008 XThreadF800002C (9) Stack: 702D0000-702E0000 +K> F800002C XThread::Execute thid 9 (handle=F800002C, 'XThread01C4 (F800002C)', native=000001C4) +F> F800002C HostPathDevice::ResolvePath() +F> F800002C HostPathDevice::ResolvePath() +F> F8000008 HostPathDevice::ResolvePath(\d4ea4615\e\46ee8ca) +F> F8000008 HostPathDevice::ResolvePath(\d4ea4615\e) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800003C type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000040 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000048 (A) Stack: 70300000-70340000 +K> F8000048 XThread::Execute thid 10 (handle=F8000048, 'XThread01C8 (F8000048)', native=000001C8) +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800003C alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000050 type=0 initial_state=0 lr=824A9F6C +!> F800002C BaseHeap::Release failed because address is not a region start +!> F800002C PhysicalHeap::Release failed due to parent heap failure +F> F800002C HostPathDevice::ResolvePath() +F> F800002C HostPathDevice::ResolvePath() +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F800004C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800003C result=00000000 lr=824AC578 guest_lr=82452E64 +!> F800002C BaseHeap::Release failed because address is not a region start +!> F800002C PhysicalHeap::Release failed due to parent heap failure +K> F800002C AUDIT-HLC NtWaitForSingleObjectEx handle=F8000028 alertable=0 lr=824AC578 guest_lr=824AFFC4 +!> F8000008 BaseHeap::Release failed because address is not a region start +!> F8000008 PhysicalHeap::Release failed due to parent heap failure +!> F8000008 BaseHeap::Release failed because address is not a region start +!> F8000008 PhysicalHeap::Release failed due to parent heap failure +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\8\3421153) +F> F8000008 DiscImageDevice::ResolvePath(\dat) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\355f2f8) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000038 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800004C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800004C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000050 type=0 initial_state=0 lr=824A9F6C +i> F8000048 XThreadF8000058 (B) Stack: 70360000-70370000 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F800004C alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 XThread::Execute thid 11 (handle=F8000058, 'XThread01CC (F8000058)', native=000001CC) +K> F8000058 AUDIT-HLC NtSetEvent handle=F800004C lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800004C result=00000000 lr=824AC578 guest_lr=8245148C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F800003C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=82452E64 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000038 type=1 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF800004C (C) Stack: 70390000-703A0000 +K> F800004C XThread::Execute thid 12 (handle=F800004C, 'XThread01D0 (F800004C)', native=000001D0) +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +i> F8000008 Hardware scaler: width ratio 1:1, height ratio 1:1, final aspect ratio 16:9 +i> 01000010 Selecting rep movs vastcpy. +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000060 type=1 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000064 type=1 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000068 (D) Stack: 703C0000-70440000 +K> F8000068 XThread::Execute thid 13 (handle=F8000068, 'XThread01D4 (F8000068)', native=000001D4) +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +F> F8000008 HostPathDevice::ResolvePath(\aab216c3\a\2c8c185) +F> F8000008 HostPathDevice::ResolvePath(\aab216c3\a) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000070 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000070 alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000078 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 AUDIT-HLC NtSetEvent handle=F8000078 lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000078 result=00000000 lr=824AC578 guest_lr=8245148C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000074 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000070 result=00000000 lr=824AC578 guest_lr=82452E64 +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\73a5c0a) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000070 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000070 alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000078 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 AUDIT-HLC NtSetEvent handle=F8000078 lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000078 result=00000000 lr=824AC578 guest_lr=8245148C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000074 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000070 result=00000000 lr=824AC578 guest_lr=82452E64 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +i> F8000008 XThreadF8000070 (E) Stack: 70460000-704E0000 +i> F8000008 XThreadF8000074 (F) Stack: 70500000-70580000 +K> F8000070 XThread::Execute thid 14 (handle=F8000070, 'XThread01D8 (F8000070)', native=000001D8) +K> F8000074 XThread::Execute thid 15 (handle=F8000074, 'XThread01DC (F8000074)', native=000001DC) +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +i> F8000008 AudioSystem::RegisterClient: driver created for index=0, driver=0x7e36a2010040 +i> F8000008 AudioSystem::RegisterClient: client 0 registered successfully +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\39a9dcc) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800008C alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000094 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800008C result=00000000 lr=824AC578 guest_lr=8245FA10 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +F> F8000008 DiscImageDevice::ResolvePath(\dat) +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000094 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800008C alertable=0 lr=824AC578 guest_lr=82460150 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800008C result=00000000 lr=824AC578 guest_lr=82460150 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800008C type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800008C alertable=0 lr=824AC578 guest_lr=82179148 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000094 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800008C result=00000000 lr=824AC578 guest_lr=82179148 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +i> F8000008 XThreadF800008C (10) Stack: 705A0000-705B0000 +K> F800008C XThread::Execute thid 16 (handle=F800008C, 'XThread01F0 (F800008C)', native=000001F0) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000094 alertable=0 lr=824AC578 guest_lr=82173BD4 +K> F8000068 AUDIT-HLC NtSetEvent handle=F8000094 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000094 result=00000000 lr=824AC578 guest_lr=82173BD4 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000098 (11) Stack: 705D0000-70650000 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000098 alertable=0 lr=824AC578 guest_lr=822F1B50 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000098 XThread::Execute thid 17 (handle=F8000098, 'XThread01F4 (F8000098)', native=000001F4) +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000098 AUDIT-HLC NtCreateEvent handle=F800009C type=1 initial_state=1 lr=824A9F6C +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000A0 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\aab216c3\5\ee70e0a) +F> F8000098 HostPathDevice::ResolvePath(\aab216c3\5) +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A0 alertable=0 lr=824AC578 guest_lr=821CBAE0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000AC alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 AUDIT-HLC NtSetEvent handle=F80000AC lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000AC result=00000000 lr=824AC578 guest_lr=8245148C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000A8 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000A0 result=00000000 lr=824AC578 guest_lr=821CBAE0 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +i> F8000098 XThreadF80000A0 (12) Stack: 70670000-70680000 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F80000A0 XThread::Execute thid 18 (handle=F80000A0, 'XThread01F8 (F80000A0)', native=000001F8) +i> F80000A0 XThreadF80000A8 (13) Stack: 706A0000-706D0000 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +i> F80000A0 XThreadF80000AC (14) Stack: 706F0000-70720000 +K> F80000A8 XThread::Execute thid 19 (handle=F80000A8, 'XThread01FC (F80000A8)', native=000001FC) +K> F80000AC XThread::Execute thid 20 (handle=F80000AC, 'XThread0200 (F80000AC)', native=00000200) +K> F80000A8 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A4 alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F80000AC AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A4 alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\c\dba806e) +F> F8000098 HostPathDevice::ResolvePath(\87719002\c) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\c\ec0a96e) +F> F8000098 HostPathDevice::ResolvePath(\87719002\c) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000C8 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\a\60fcb85) +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +F> F8000098 HostPathDevice::ResolvePath(\87719002\a) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000D4 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +F> F8000098 HostPathDevice::ResolvePath(\87719002\2\85d8849) +F> F8000098 HostPathDevice::ResolvePath(\87719002\2) +F> F80000A0 DiscImageDevice::ResolvePath(\hidden\Resource3D) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000E4 type=0 initial_state=0 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000E8 type=1 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\a\715f485) +F> F8000098 HostPathDevice::ResolvePath(\87719002\a) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000F4 type=0 initial_state=0 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E8 alertable=0 lr=824AC578 guest_lr=822DFCC8 +F> F8000098 HostPathDevice::ResolvePath(\87719002\c\f2a8ccd) +F> F8000098 HostPathDevice::ResolvePath(\87719002\c) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\0\1a2db9c) +F> F8000098 HostPathDevice::ResolvePath(\87719002\0) +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C515C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000B8 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000C4 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D0 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000DC lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000F0 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C515C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000F8 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E8 result=00000000 lr=824AC578 guest_lr=822DFCC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000100 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E8 alertable=0 lr=824AC578 guest_lr=822DFE24 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000098 result=00000000 lr=824AC578 guest_lr=822F1B50 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F800010C lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000B4 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E8 result=00000000 lr=824AC578 guest_lr=822DFE24 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E8 alertable=0 lr=824AC578 guest_lr=822DFED0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF80000C0 (15) Stack: 705D0000-705E0000 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C4 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F80000C0 XThread::Execute thid 21 (handle=F80000C0, 'XThread0204 (F80000C0)', native=00000204) +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C4 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000094 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E8 result=00000000 lr=824AC578 guest_lr=822DFED0 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000094 type=1 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +i> F8000008 XThreadF8000098 (16) Stack: 70600000-70610000 +K> F8000098 XThread::Execute thid 22 (handle=F8000098, 'XThread0208 (F8000098)', native=00000208) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000CC type=0 initial_state=0 lr=824A9F6C +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000CC lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000CC alertable=0 lr=824AC578 guest_lr=82172BC8 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000CC result=00000000 lr=824AC578 guest_lr=82172BC8 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000094 alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +F> F80000A0 DiscImageDevice::ResolvePath(\hidden\Resource3D) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000D0 type=1 initial_state=0 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFCC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFCC8 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFE24 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E4 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000E8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF80000E4 (17) Stack: 70630000-70640000 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFE24 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFED0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F80000E4 XThread::Execute thid 23 (handle=F80000E4, 'XThread020C (F80000E4)', native=0000020C) +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000F8 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000100 (18) Stack: 70740000-707C0000 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF800010C (19) Stack: 707E0000-70860000 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000100 XThread::Execute thid 24 (handle=F8000100, 'XThread0210 (F8000100)', native=00000210) +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F800010C XThread::Execute thid 25 (handle=F800010C, 'XThread0214 (F800010C)', native=00000214) +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFED0 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +F> F80000A0 DiscImageDevice::ResolvePath(\hidden\Resource3D) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000D0 type=1 initial_state=0 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFCC8 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000108 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFCC8 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B0 alertable=0 lr=824AC578 guest_lr=821CC19C +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000B0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B0 result=00000000 lr=824AC578 guest_lr=821CC19C +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFE24 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000B0 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFE24 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFED0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000B0 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFED0 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\f\ca5c62e) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\d\14ba3f8) +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\d) +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B0 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D0 type=0 initial_state=0 lr=824A9F6C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D0 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B0 result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\8\14c242d) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\5\6324af0) +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\5) +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B0 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D0 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B0 result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\d\70a9531) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\a\c9606f9) +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\a) +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B0 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D0 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B0 result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\7\9f2d535) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\4\efaecd1) +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\4) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B0 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D0 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D0 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B0 result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\7\0c3bba2) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\4\59fbfe8) +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\4) +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B0 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D0 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B0 result=00000000 lr=824AC578 guest_lr=8245FA10 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800009C alertable=0 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800009C result=00000000 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800009C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B0 alertable=0 lr=824AC578 guest_lr=821CC19C +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000B0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B0 result=00000000 lr=824AC578 guest_lr=821CC19C +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800009C alertable=0 lr=824AC578 guest_lr=823DEF4C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800009C result=00000000 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800009C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF80000BC (1A) Stack: 70880000-70900000 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F80000BC XThread::Execute thid 26 (handle=F80000BC, 'XThread0218 (F80000BC)', native=00000218) +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F80000BC AUDIT-HLC NtCreateEvent handle=F80000CC type=1 initial_state=1 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F80000BC AUDIT-HLC NtCreateEvent handle=F80000D0 type=0 initial_state=0 lr=824A9F6C +F> F80000BC HostPathDevice::ResolvePath(\aab216c3\5\c10eae6) +F> F80000BC HostPathDevice::ResolvePath(\aab216c3\5) +K> F80000BC AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=821CBAE0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000110 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 AUDIT-HLC NtSetEvent handle=F8000110 lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000110 result=00000000 lr=824AC578 guest_lr=8245148C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000108 lr=824AA304 +K> F80000BC AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=821CBAE0 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800008C AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +F> F800008C DiscImageDevice::ResolvePath(\dat) +K> F800008C AUDIT-HLC NtSetEvent handle=F8000110 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D8 alertable=0 lr=824AC578 guest_lr=82460150 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D8 result=00000000 lr=824AC578 guest_lr=82460150 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B0 alertable=0 lr=824AC578 guest_lr=82172BC8 +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000B0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B0 result=00000000 lr=824AC578 guest_lr=82172BC8 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +F> F8000008 DiscImageDevice::ResolvePath(\dat\movie) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000118 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800011C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000120 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000124 type=0 initial_state=1 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000128 type=0 initial_state=1 lr=824A9F6C +F> F8000008 DiscImageDevice::ResolvePath(\dat\movie) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000130 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000134 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000138 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800013C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000140 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000144 type=0 initial_state=1 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000148 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800014C type=0 initial_state=1 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +i> F8000008 XThreadF8000150 (1B) Stack: 70880000-70890000 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +i> F8000008 XThreadF8000154 (1C) Stack: 708B0000-708C0000 +i> F8000008 XThreadF8000158 (1D) Stack: 708E0000-708F0000 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +i> F8000008 XThreadF800015C (1E) Stack: 70910000-70920000 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25404 lr=82507ABC +K> F8000150 XThread::Execute thid 27 (handle=F8000150, 'XThread021C (F8000150)', native=0000021C) +K> F8000154 XThread::Execute thid 28 (handle=F8000154, 'XThread0220 (F8000154)', native=00000220) +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 XThread::Execute thid 29 (handle=F8000158, 'XThread0224 (F8000158)', native=00000224) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000150 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800008C AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C diff --git a/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.stdout.run4_toml b/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.stdout.run4_toml new file mode 100644 index 0000000..e71f97f --- /dev/null +++ b/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.stdout.run4_toml @@ -0,0 +1,36329 @@ +i> 000000D4 Build: canary_experimental@99fd19d02 on Jun 5 2026 +i> 000000D4 Storage root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug +i> 000000D4 ----------- CONFIG DUMP ----------- + +[APU] +apu = "any" +apu_max_queued_frames = 8 +enable_xmp = true +ffmpeg_verbose = false +mute = false +use_dedicated_xma_thread = true +xma_decoder = "new" + +[Auditing] +audit_handle_lifecycle = true +audit_jit_prolog_pc = 2182835700 + +[CPU] +break_condition_gpr = -1 +break_condition_op = "eq" +break_condition_truncate = true +break_condition_value = 0 +break_on_debugbreak = true +break_on_instruction = 0 +break_on_start = false +break_on_unimplemented_instructions = true +clock_no_scaling = false +clock_source_raw = false +cpu = "any" +debug_symbol_loader = false +debugprint_trap_log = false +disable_context_promotion = false +disable_instruction_infocache = false +disable_prefetch_and_cachecontrol = true +disassemble_functions = false +dump_translated_hir_functions = false +elide_e0_check = false +emit_inline_mmio_checks = false +emit_mmio_aware_stores_for_recorded_exception_addresses = true +emit_source_annotations = false +enable_early_precompilation = false +full_optimization_even_with_debug = false +ignore_trap_instructions = true +ignore_undefined_externs = true +inline_loadclock = false +inline_mmio_access = true +load_module_map = "" +no_reserved_ops = false +no_round_to_single = false +permit_float_constant_evaluation = false +pvr = 7407360 +record_mmio_access_exceptions = true +store_all_context_values = false +trace_function_coverage = false +trace_function_data = false +trace_function_data_path = "" +trace_function_references = false +trace_functions = false +use_fast_dot_product = false +validate_hir = false +writable_code_segments = false + +[Config] +defaults_date = 2026040912 + +[Content] +license_mask = 0 + +[D3D12] +d3d12_adapter = -1 +d3d12_allow_variable_refresh_rate_and_tearing = true +d3d12_bindless = true +d3d12_break_on_error = false +d3d12_break_on_warning = false +d3d12_debug = false +d3d12_dxbc_disasm = false +d3d12_dxbc_disasm_dxilconv = false +d3d12_pipeline_creation_threads = -1 +d3d12_queue_priority = 1 +d3d12_submit_on_primary_buffer_end = true +d3d12_tessellation_wireframe = false + +[Display] +fullscreen = false +host_present_from_non_ui_thread = true +postprocess_antialiasing = "" +postprocess_dither = true +postprocess_ffx_cas_additional_sharpness = 0 +postprocess_ffx_fsr_max_upsampling_passes = 4 +postprocess_ffx_fsr_sharpness_reduction = 0.20000000298023224 +postprocess_scaling_and_sharpening = "" +present_letterbox = true +present_render_pass_clear = true +present_safe_area_x = 100 +present_safe_area_y = 100 + +[GPU] +anisotropic_override = -1 +async_shader_compilation = true +clear_memory_page_state = false +depth_float24_convert_in_pixel_shader = false +depth_float24_round = false +depth_transfer_not_equal_test = true +disassemble_pm4 = false +draw_resolution_scale_x = 1 +draw_resolution_scale_y = 1 +draw_resolution_scaled_texture_offsets = true +dump_shaders = "" +dxbc_source_map = false +dxbc_switch = true +execute_unclipped_draw_vs_on_cpu = true +execute_unclipped_draw_vs_on_cpu_for_psi_render_backend = true +execute_unclipped_draw_vs_on_cpu_with_scissor = false +force_convert_line_loops_to_strips = false +force_convert_quad_lists_to_triangle_lists = false +force_convert_triangle_fans_to_lists = false +framerate_limit = 0 +gamma_render_target_as_unorm16 = true +gpu = "any" +gpu_3d_to_2d_texture = true +gpu_allow_invalid_fetch_constants = true +gpu_allow_invalid_upload_range = false +half_pixel_offset = true +ignore_32bit_vertex_index_support = false +log_guest_driven_gpu_register_written_values = false +log_ringbuffer_kickoff_initiator_bts = false +mrt_edram_used_range_clamp_to_min = true +native_2x_msaa = true +native_stencil_value_output = true +native_stencil_value_output_d3d12_intel = false +no_discard_stencil_in_transfer_pipelines = false +non_seamless_cube_map = true +occlusion_query = "fast" +occlusion_query_fake_lower_threshold = 80 +occlusion_query_fake_upper_threshold = 100 +occlusion_query_querybatch_range = 0 +occlusion_query_saturation = 1 +primitive_processor_cache_min_indices = 4096 +readback_memexport = false +readback_resolve = "none" +render_target_path_d3d12 = "" +render_target_path_vulkan = "" +resolve_resolution_scale_fill_half_pixel_offset = true +snorm16_render_target_full_range = true +store_shaders = true +target_trace_file = "" +texture_cache_memory_limit_hard = 768 +texture_cache_memory_limit_render_to_texture = 24 +texture_cache_memory_limit_soft = 384 +texture_cache_memory_limit_soft_lifetime = 30 +tiled_shared_memory = true +trace_dump_path = "" +trace_gpu_prefix = "scratch/gpu/" +trace_gpu_stream = false +use_fuzzy_alpha_epsilon = false +vsync = true + +[General] +allow_game_relative_writes = false +allow_plugins = false +apply_patches = true +controller_hotkeys = false +debug = false +disable_doubleclick_fullscreen = false +discord = true +launch_module = "" +notification_sound_path = "" +priority_class = 0 +recent_titles_entry_amount = 10 +time_scalar = 1 + +[HACKS] +ac6_ground_fix = false + +[HID] +guide_button = true +hid = "any" +keyboard_mode = 0 +keyboard_user_index = 0 +left_stick_deadzone_percentage = 0 +right_stick_deadzone_percentage = 0 +vibration = true + +[HID.WinKey] +keybind_a = "0xBA" +keybind_b = "0xDE" +keybind_back = "Z" +keybind_dpad_down = "^S" +keybind_dpad_left = "^A" +keybind_dpad_right = "^D" +keybind_dpad_up = "^W" +keybind_guide = "0x08" +keybind_left_shoulder = "1" +keybind_left_thumb = "F" +keybind_left_thumb_down = "_S" +keybind_left_thumb_left = "_A" +keybind_left_thumb_right = "_D" +keybind_left_thumb_up = "_W" +keybind_left_trigger = "Q I" +keybind_right_shoulder = "3" +keybind_right_thumb = "K" +keybind_right_thumb_down = "0x28" +keybind_right_thumb_left = "0x25" +keybind_right_thumb_right = "0x27" +keybind_right_thumb_up = "0x26" +keybind_right_trigger = "E O" +keybind_start = "X" +keybind_x = "L" +keybind_y = "P" + +[Kernel] +allow_avatar_initialization = false +allow_incompatible_title_update = true +apply_title_update = true +cl = "" +console_type = 0 +default_achievements_backend = "GPD" +ignore_thread_affinities = true +ignore_thread_priorities = false +kernel_build_version = 1888 +kernel_cert_monitor = false +kernel_debug_monitor = false +kernel_display_gamma_power = 2.22222233 +kernel_display_gamma_type = 2 +kernel_pix = false +staging_mode = false + +[Logging] +enable_console = false +flush_log = true +log_file = "" +log_high_frequency_kernel_calls = false +log_level = 2 +log_mask = 0 +log_string_format_kernel_calls = false +log_to_debugprint = false +log_to_stdout = true + +[Memory] +ignore_offset_for_ranged_allocations = false +protect_on_release = false +protect_zero = true +scribble_heap = false +scribble_heap_value = 0 +writable_executable_memory = true + +[Profiles] +logged_profile_slot_0_xuid = "" +logged_profile_slot_1_xuid = "" +logged_profile_slot_2_xuid = "" +logged_profile_slot_3_xuid = "" + +[SDL] +mappings_file = "gamecontrollerdb.txt" + +[Storage] +cache_root = "" +content_root = "" +force_mount_devkit = false +mount_cache = true +mount_memory_unit = false +mount_scratch = false +storage_root = "" + +[UI] +custom_font_path = "" +font_size = 14 +headless = false +imgui_debug = false +profiler_dpi_scaling = false +show_achievement_notification = false +show_profiler = false +storage_selection_dialog = false +window_size_x = 1280 +window_size_y = 720 + +[Video] +avpack = 8 +custom_internal_display_resolution_x = 0 +custom_internal_display_resolution_y = 0 +enable_3d_mode = false +interlaced = false + +[Vulkan] +vulkan_allow_present_mode_fifo_relaxed = true +vulkan_allow_present_mode_immediate = true +vulkan_allow_present_mode_mailbox = true +vulkan_device = -1 +vulkan_log_debug_messages = true +vulkan_pipeline_creation_threads = -1 +vulkan_semaphore_reuse_workaround = false +vulkan_sparse_shared_memory = true +vulkan_validation = false + +[Win32] +win32_high_resolution_timer = true +win32_mmcss = true + +[x64] +align_all_basic_blocks = 0 +delay_via_maybeyield = false +enable_host_guest_stack_synchronization = true +enable_incorrect_roundingmode_behavior = false +enable_rmw_context_merging = false +instrument_call_times = false +max_stackpoints = 65536 +x64_extension_mask = -1 +xop_arithmetic_right_shifts = false +xop_compares = true +xop_left_shifts = false +xop_right_shifts = false +xop_rotates = false +----------- END OF CONFIG DUMP ---- +i> 000000D4 Loaded config: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\xenia-canary.config.toml +i> 000000D4 Content root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\content +i> 000000D4 Host cache root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\cache_host +w> 000000D4 Unable to load Japanese font; JP characters will be boxes +w> 000000D4 Unable to load Japanese font; JP characters will be boxes +i> 00000124 Setup: Initializing Memory... +i> 00000124 Setup: Initializing Exports... +i> 00000124 Setup: Initializing Processor... +i> 00000124 Setup: Initializing Audio... +i> 00000124 Setup: Initializing Graphics... +i> 00000124 Setup: Initializing HID... +i> 00000124 winkey: "0x08" binds key 0x8 to controller input GUIDE. +i> 00000124 winkey: "^A" binds key 0x41 to controller input DPAD_LEFT. +i> 00000124 winkey: "^D" binds key 0x44 to controller input DPAD_RIGHT. +i> 00000124 winkey: "^S" binds key 0x53 to controller input DPAD_DOWN. +i> 00000124 winkey: "^W" binds key 0x57 to controller input DPAD_UP. +i> 00000124 winkey: "_A" binds key 0x41 to controller input LEFT_THUMB_LEFT. +i> 00000124 winkey: "_D" binds key 0x44 to controller input LEFT_THUMB_RIGHT. +i> 00000124 winkey: "_S" binds key 0x53 to controller input LEFT_THUMB_DOWN. +i> 00000124 winkey: "_W" binds key 0x57 to controller input LEFT_THUMB_UP. +i> 00000124 winkey: "F" binds key 0x46 to controller input LEFT_THUMB_PRESSED. +i> 00000124 winkey: "0x26" binds key 0x26 to controller input RIGHT_THUMB_UP. +i> 00000124 winkey: "0x28" binds key 0x28 to controller input RIGHT_THUMB_DOWN. +i> 00000124 winkey: "0x27" binds key 0x27 to controller input RIGHT_THUMB_RIGHT. +i> 00000124 winkey: "0x25" binds key 0x25 to controller input RIGHT_THUMB_LEFT. +i> 00000124 winkey: "K" binds key 0x4B to controller input RIGHT_THUMB_PRESSED. +i> 00000124 winkey: "L" binds key 0x4C to controller input X. +i> 00000124 winkey: "0xDE" binds key 0xDE to controller input B. +i> 00000124 winkey: "0xBA" binds key 0xBA to controller input A. +i> 00000124 winkey: "P" binds key 0x50 to controller input Y. +i> 00000124 winkey: "Q" binds key 0x51 to controller input LEFT_TRIGGER. +i> 00000124 winkey: "I" binds key 0x49 to controller input LEFT_TRIGGER. +i> 00000124 winkey: "E" binds key 0x45 to controller input RIGHT_TRIGGER. +i> 00000124 winkey: "O" binds key 0x4F to controller input RIGHT_TRIGGER. +i> 00000124 winkey: "Z" binds key 0x5A to controller input BACK. +i> 00000124 winkey: "X" binds key 0x58 to controller input START. +i> 00000124 winkey: "1" binds key 0x31 to controller input LEFT_SHOULDER. +i> 00000124 winkey: "3" binds key 0x33 to controller input RIGHT_SHOULDER. +i> 000000D4 SDL Version 2.32.2 initialized. +w> 000000D4 SDL GameControllerDB: file 'gamecontrollerdb.txt' does not exist. +i> 00000124 Setup: Initializing VFS... +i> 00000124 PatchDB: Loaded patches for 0 titles +i> 00000124 Setup: Initializing Kernel... +i> 00000124 ProfileManager: Found 0 Profiles +w> 00000124 BaseHeap::AllocFixed attempting commit on unreserved page +w> 00000124 BaseHeap::AllocFixed attempting commit on unreserved page +i> 00000124 Setup: Starting graphics_system... +i> 00000124 DXGI adapter: NVIDIA GeForce GTX 1070 Ti (vendor 0x1002, device 0x73DF) +i> 00000124 Direct3D 12 device and OS features: +* Max GPU virtual address bits per resource: 40 +* Non-zeroed heap creation: yes +* Pixel-shader-specified stencil reference: no +* Programmable sample positions: tier 0 +* Rasterizer-ordered views: yes +* Resource binding: tier 3 +* Tiled resources: tier 4 +* Unaligned block-compressed textures: yes +i> 00000124 XThread01000010 (1) Stack: 70010000-70030000 +i> 00000124 XThread01000014 (2) Stack: 70050000-70070000 +i> 00000124 Setup: Starting audio_system... +K> 01000010 XThread::Execute thid 1 (handle=01000010, 'GPU Commands (01000010)', native=00000154, ) +K> 01000014 XThread::Execute thid 2 (handle=01000014, 'GPU Frame limiter (01000014)', native=00000158, ) +i> 00000124 XThread01000018 (3) Stack: 70090000-700B0000 +i> 00000124 XThread0100001C (4) Stack: 700D0000-700F0000 +K> 01000018 XThread::Execute thid 3 (handle=01000018, 'XMA Decoder (01000018)', native=00000180, ) +K> 0100001C XThread::Execute thid 4 (handle=0100001C, 'Audio Worker (0100001C)', native=00000184, ) +i> 000000D4 Checking for XISO +F> 000000D4 DiscImageDevice::Initialize +i> 000000D4 Checking for XISO +F> 000000D4 DiscImageDevice::Initialize +F> 000000D4 DiscImageDevice::Initialize +i> 000000D4 Loading module GAME:\default.xex +F> 000000D4 DiscImageDevice::ResolvePath(\default.xex) +i> 000000D4 Module \Device\Cdrom0\default.xex: +Module Hash: CCF935D24A74E002 + Module Flags: 00000001 + XEX_MODULE_TITLE +Security Header: + Image Flags: 00000008 + XEX_IMAGE_XGD2_MEDIA_ONLY + Load Address: 82000000 + Image Size: 00920000 + Export Table: 00000000 +Optional Header Count: 15 + XEX_HEADER_RESOURCE_INFO: + 535107D4 828FB900-8291D8CF, 139215b + XEX_HEADER_FILE_FORMAT_INFO: + Info Size: 36 + Encryption Type: Normal + Compression Type: Normal + Window Size: 32768 + Block Size: 61440 + Block Hash: B3 2B D7 D4 EF 96 9A C5 9F D7 77 C6 8A 99 AA 1C BD 87 1C BE 00 90 2E F1 46 3F A3 D7 00 00 00 10 + XEX_HEADER_ENTRY_POINT: 824AB748 + XEX_HEADER_IMAGE_BASE_ADDRESS: 82000000 + XEX_HEADER_IMPORT_LIBRARIES: + xam.xex - 104 imports + Version: 2.0.4552.0 + Min Version: 2.0.4552.0 + xboxkrnl.exe - 294 imports + Version: 2.0.4552.0 + Min Version: 2.0.4552.0 + XEX_HEADER_CHECKSUM_TIMESTAMP: + Checksum : 00902EF1 + Time Stamp: 463FA3D7 - Tue May 8 00:10:31 2007 + XEX_HEADER_ORIGINAL_PE_NAME: default.pe + XEX_HEADER_STATIC_LIBRARIES: + XAPILIB : 2.0.3215.0 + D3D9 : 2.0.3215.1 + D3DX9 : 2.0.3215.0 + XBOXKRNL : 2.0.3215.0 + XAUD : 2.0.3215.0 + LIBCPMT : 2.0.3215.0 + XMP : 2.0.3215.0 + XMEDIA : 2.0.3215.0 + XONLINE : 2.0.3215.0 + XGRAPHC : 2.0.3215.0 + X3DAUD : 2.0.3215.1 + XACT : 2.0.3215.1 + XEX_HEADER_TLS_INFO: + Slot Count: 64 + Raw Data Address: 00000000 + Data Size: 0 + Raw Data Size: 0 + XEX_HEADER_DEFAULT_STACK_SIZE: 524288 + XEX_HEADER_SYSTEM_FLAGS: 00000400 + XEX_SYSTEM_PAL50_INCOMPATIBLE + XEX_HEADER_EXECUTION_INFO: + Media ID: 2D2E2EEB + Title ID: 535107D4 + Savegame ID: 535107D4 + Disc Number / Total: 1 / 1 + XEX_HEADER_GAME_RATINGS: + ESRB: Teen + PEGI: 12+ + PEGI-FI: 11+ + PEGI - PT: 12+ + BBFC: 12+ + CERO: Unrated + USK: Approved for children aged 12 and above + OFLC - AU: Parental Guidance + OFLC - NZ: Parental Guidance + KMRB: Unrated + Brazil: Unrated + FPB: 13+ + XEX_HEADER_LAN_KEY: E0 3C EA 47 3C AE 06 62 98 8F DB 7F 58 50 12 38 + XEX_HEADER_XBOX360_LOGO: + Section Size: 1736 + Logo Size: 1728 +Sections: + 0 RODATA 1 pages 82000000 - 82010000 (65536 bytes) + 1 RODATA 1 pages 82010000 - 82020000 (65536 bytes) + 2 RODATA 1 pages 82020000 - 82030000 (65536 bytes) + 3 RODATA 1 pages 82030000 - 82040000 (65536 bytes) + 4 RODATA 1 pages 82040000 - 82050000 (65536 bytes) + 5 RODATA 1 pages 82050000 - 82060000 (65536 bytes) + 6 RODATA 1 pages 82060000 - 82070000 (65536 bytes) + 7 RODATA 1 pages 82070000 - 82080000 (65536 bytes) + 8 RODATA 1 pages 82080000 - 82090000 (65536 bytes) + 9 RODATA 1 pages 82090000 - 820A0000 (65536 bytes) + 10 RODATA 1 pages 820A0000 - 820B0000 (65536 bytes) + 11 RODATA 1 pages 820B0000 - 820C0000 (65536 bytes) + 12 RODATA 1 pages 820C0000 - 820D0000 (65536 bytes) + 13 RODATA 1 pages 820D0000 - 820E0000 (65536 bytes) + 14 RODATA 1 pages 820E0000 - 820F0000 (65536 bytes) + 15 RODATA 1 pages 820F0000 - 82100000 (65536 bytes) + 16 RODATA 1 pages 82100000 - 82110000 (65536 bytes) + 17 RODATA 1 pages 82110000 - 82120000 (65536 bytes) + 18 RODATA 1 pages 82120000 - 82130000 (65536 bytes) + 19 RODATA 1 pages 82130000 - 82140000 (65536 bytes) + 20 RODATA 1 pages 82140000 - 82150000 (65536 bytes) + 21 CODE 1 pages 82150000 - 82160000 (65536 bytes) + 22 CODE 1 pages 82160000 - 82170000 (65536 bytes) + 23 CODE 1 pages 82170000 - 82180000 (65536 bytes) + 24 CODE 1 pages 82180000 - 82190000 (65536 bytes) + 25 CODE 1 pages 82190000 - 821A0000 (65536 bytes) + 26 CODE 1 pages 821A0000 - 821B0000 (65536 bytes) + 27 CODE 1 pages 821B0000 - 821C0000 (65536 bytes) + 28 CODE 1 pages 821C0000 - 821D0000 (65536 bytes) + 29 CODE 1 pages 821D0000 - 821E0000 (65536 bytes) + 30 CODE 1 pages 821E0000 - 821F0000 (65536 bytes) + 31 CODE 1 pages 821F0000 - 82200000 (65536 bytes) + 32 CODE 1 pages 82200000 - 82210000 (65536 bytes) + 33 CODE 1 pages 82210000 - 82220000 (65536 bytes) + 34 CODE 1 pages 82220000 - 82230000 (65536 bytes) + 35 CODE 1 pages 82230000 - 82240000 (65536 bytes) + 36 CODE 1 pages 82240000 - 82250000 (65536 bytes) + 37 CODE 1 pages 82250000 - 82260000 (65536 bytes) + 38 CODE 1 pages 82260000 - 82270000 (65536 bytes) + 39 CODE 1 pages 82270000 - 82280000 (65536 bytes) + 40 CODE 1 pages 82280000 - 82290000 (65536 bytes) + 41 CODE 1 pages 82290000 - 822A0000 (65536 bytes) + 42 CODE 1 pages 822A0000 - 822B0000 (65536 bytes) + 43 CODE 1 pages 822B0000 - 822C0000 (65536 bytes) + 44 CODE 1 pages 822C0000 - 822D0000 (65536 bytes) + 45 CODE 1 pages 822D0000 - 822E0000 (65536 bytes) + 46 CODE 1 pages 822E0000 - 822F0000 (65536 bytes) + 47 CODE 1 pages 822F0000 - 82300000 (65536 bytes) + 48 CODE 1 pages 82300000 - 82310000 (65536 bytes) + 49 CODE 1 pages 82310000 - 82320000 (65536 bytes) + 50 CODE 1 pages 82320000 - 82330000 (65536 bytes) + 51 CODE 1 pages 82330000 - 82340000 (65536 bytes) + 52 CODE 1 pages 82340000 - 82350000 (65536 bytes) + 53 CODE 1 pages 82350000 - 82360000 (65536 bytes) + 54 CODE 1 pages 82360000 - 82370000 (65536 bytes) + 55 CODE 1 pages 82370000 - 82380000 (65536 bytes) + 56 CODE 1 pages 82380000 - 82390000 (65536 bytes) + 57 CODE 1 pages 82390000 - 823A0000 (65536 bytes) + 58 CODE 1 pages 823A0000 - 823B0000 (65536 bytes) + 59 CODE 1 pages 823B0000 - 823C0000 (65536 bytes) + 60 CODE 1 pages 823C0000 - 823D0000 (65536 bytes) + 61 CODE 1 pages 823D0000 - 823E0000 (65536 bytes) + 62 CODE 1 pages 823E0000 - 823F0000 (65536 bytes) + 63 CODE 1 pages 823F0000 - 82400000 (65536 bytes) + 64 CODE 1 pages 82400000 - 82410000 (65536 bytes) + 65 CODE 1 pages 82410000 - 82420000 (65536 bytes) + 66 CODE 1 pages 82420000 - 82430000 (65536 bytes) + 67 CODE 1 pages 82430000 - 82440000 (65536 bytes) + 68 CODE 1 pages 82440000 - 82450000 (65536 bytes) + 69 CODE 1 pages 82450000 - 82460000 (65536 bytes) + 70 CODE 1 pages 82460000 - 82470000 (65536 bytes) + 71 CODE 1 pages 82470000 - 82480000 (65536 bytes) + 72 CODE 1 pages 82480000 - 82490000 (65536 bytes) + 73 CODE 1 pages 82490000 - 824A0000 (65536 bytes) + 74 CODE 1 pages 824A0000 - 824B0000 (65536 bytes) + 75 CODE 1 pages 824B0000 - 824C0000 (65536 bytes) + 76 CODE 1 pages 824C0000 - 824D0000 (65536 bytes) + 77 CODE 1 pages 824D0000 - 824E0000 (65536 bytes) + 78 CODE 1 pages 824E0000 - 824F0000 (65536 bytes) + 79 CODE 1 pages 824F0000 - 82500000 (65536 bytes) + 80 CODE 1 pages 82500000 - 82510000 (65536 bytes) + 81 CODE 1 pages 82510000 - 82520000 (65536 bytes) + 82 CODE 1 pages 82520000 - 82530000 (65536 bytes) + 83 CODE 1 pages 82530000 - 82540000 (65536 bytes) + 84 CODE 1 pages 82540000 - 82550000 (65536 bytes) + 85 CODE 1 pages 82550000 - 82560000 (65536 bytes) + 86 CODE 1 pages 82560000 - 82570000 (65536 bytes) + 87 CODE 1 pages 82570000 - 82580000 (65536 bytes) + 88 CODE 1 pages 82580000 - 82590000 (65536 bytes) + 89 CODE 1 pages 82590000 - 825A0000 (65536 bytes) + 90 CODE 1 pages 825A0000 - 825B0000 (65536 bytes) + 91 CODE 1 pages 825B0000 - 825C0000 (65536 bytes) + 92 CODE 1 pages 825C0000 - 825D0000 (65536 bytes) + 93 CODE 1 pages 825D0000 - 825E0000 (65536 bytes) + 94 CODE 1 pages 825E0000 - 825F0000 (65536 bytes) + 95 CODE 1 pages 825F0000 - 82600000 (65536 bytes) + 96 CODE 1 pages 82600000 - 82610000 (65536 bytes) + 97 CODE 1 pages 82610000 - 82620000 (65536 bytes) + 98 CODE 1 pages 82620000 - 82630000 (65536 bytes) + 99 CODE 1 pages 82630000 - 82640000 (65536 bytes) + 100 CODE 1 pages 82640000 - 82650000 (65536 bytes) + 101 CODE 1 pages 82650000 - 82660000 (65536 bytes) + 102 CODE 1 pages 82660000 - 82670000 (65536 bytes) + 103 CODE 1 pages 82670000 - 82680000 (65536 bytes) + 104 CODE 1 pages 82680000 - 82690000 (65536 bytes) + 105 CODE 1 pages 82690000 - 826A0000 (65536 bytes) + 106 CODE 1 pages 826A0000 - 826B0000 (65536 bytes) + 107 CODE 1 pages 826B0000 - 826C0000 (65536 bytes) + 108 CODE 1 pages 826C0000 - 826D0000 (65536 bytes) + 109 CODE 1 pages 826D0000 - 826E0000 (65536 bytes) + 110 CODE 1 pages 826E0000 - 826F0000 (65536 bytes) + 111 CODE 1 pages 826F0000 - 82700000 (65536 bytes) + 112 CODE 1 pages 82700000 - 82710000 (65536 bytes) + 113 CODE 1 pages 82710000 - 82720000 (65536 bytes) + 114 CODE 1 pages 82720000 - 82730000 (65536 bytes) + 115 CODE 1 pages 82730000 - 82740000 (65536 bytes) + 116 CODE 1 pages 82740000 - 82750000 (65536 bytes) + 117 CODE 1 pages 82750000 - 82760000 (65536 bytes) + 118 CODE 1 pages 82760000 - 82770000 (65536 bytes) + 119 CODE 1 pages 82770000 - 82780000 (65536 bytes) + 120 CODE 1 pages 82780000 - 82790000 (65536 bytes) + 121 CODE 1 pages 82790000 - 827A0000 (65536 bytes) + 122 CODE 1 pages 827A0000 - 827B0000 (65536 bytes) + 123 CODE 1 pages 827B0000 - 827C0000 (65536 bytes) + 124 CODE 1 pages 827C0000 - 827D0000 (65536 bytes) + 125 CODE 1 pages 827D0000 - 827E0000 (65536 bytes) + 126 CODE 1 pages 827E0000 - 827F0000 (65536 bytes) + 127 CODE 1 pages 827F0000 - 82800000 (65536 bytes) + 128 CODE 1 pages 82800000 - 82810000 (65536 bytes) + 129 CODE 1 pages 82810000 - 82820000 (65536 bytes) + 130 CODE 1 pages 82820000 - 82830000 (65536 bytes) + 131 CODE 1 pages 82830000 - 82840000 (65536 bytes) + 132 CODE 1 pages 82840000 - 82850000 (65536 bytes) + 133 CODE 1 pages 82850000 - 82860000 (65536 bytes) + 134 CODE 1 pages 82860000 - 82870000 (65536 bytes) + 135 RWDATA 1 pages 82870000 - 82880000 (65536 bytes) + 136 RWDATA 1 pages 82880000 - 82890000 (65536 bytes) + 137 RWDATA 1 pages 82890000 - 828A0000 (65536 bytes) + 138 RWDATA 1 pages 828A0000 - 828B0000 (65536 bytes) + 139 RWDATA 1 pages 828B0000 - 828C0000 (65536 bytes) + 140 RWDATA 1 pages 828C0000 - 828D0000 (65536 bytes) + 141 RWDATA 1 pages 828D0000 - 828E0000 (65536 bytes) + 142 RWDATA 1 pages 828E0000 - 828F0000 (65536 bytes) + 143 RWDATA 1 pages 828F0000 - 82900000 (65536 bytes) + 144 RWDATA 1 pages 82900000 - 82910000 (65536 bytes) + 145 RWDATA 1 pages 82910000 - 82920000 (65536 bytes) +Imports: + xam - 52 imports + Version: 0.0.4552.32 + Min Version: 0.0.4552.32 + + Total: 52 + Known: 100% (52 known, 0 unknown) + Implemented: 98% (51 implemented, 1 unimplemented) + + F 82000600 8284DA7C 28C ( 652) XNotifyPositionUI + F 82000604 8284DA8C 2BC ( 700) XamShowSigninUI + F 82000608 8284DA9C 2C1 ( 705) XamShowKeyboardUI + F 8200060C 8284DAAC 2D5 ( 725) !! XamShowGamerCardUIForXUID + F 82000610 8284DABC 2CB ( 715) XamShowDeviceSelectorUI + F 82000614 8284DACC 2D9 ( 729) XamShowDirtyDiscErrorUI + F 82000618 8284DADC 1B3 ( 435) XamTaskShouldExit + F 8200061C 8284DAEC 1B1 ( 433) XamTaskCloseHandle + F 82000620 8284DAFC 1AF ( 431) XamTaskSchedule + F 82000624 8284DB0C 1A4 ( 420) XamLoaderLaunchTitle + F 82000628 8284DB1C 1F7 ( 503) XMsgStartIORequest + F 8200062C 8284DB2C 20E ( 526) XamUserGetName + F 82000630 8284DB3C 210 ( 528) XamUserGetSigninState + F 82000634 8284DB4C 282 ( 642) XamGetSystemVersion + F 82000638 8284DB5C 2F7 ( 759) XamUserCreateStatsEnumerator + F 8200063C 8284DB6C 2EE ( 750) XamUserCreateAchievementEnumerator + F 82000640 8284DB7C 20A ( 522) XamUserGetXUID + F 82000644 8284DB8C 250 ( 592) XamEnumerate + F 82000648 8284DB9C 3CC ( 972) XGetGameRegion + F 8200064C 8284DBAC 190 ( 400) XamInputGetCapabilities + F 82000650 8284DBBC 191 ( 401) XamInputGetState + F 82000654 8284DBCC 192 ( 402) XamInputSetState + F 82000658 8284DBDC 198 ( 408) XamInputGetKeystrokeEx + F 8200065C 8284DBEC 258 ( 600) XamContentCreate + F 82000660 8284DBFC 25B ( 603) XamContentDelete + F 82000664 8284DC0C 25A ( 602) XamContentClose + F 82000668 8284DC1C 260 ( 608) XamContentSetThumbnail + F 8200066C 8284DC2C 262 ( 610) XamContentGetCreator + F 82000670 8284DC3C 25C ( 604) XamContentCreateEnumerator + F 82000674 8284DC4C 265 ( 613) XamContentGetDeviceState + F 82000678 8284DC5C 25E ( 606) XamContentGetDeviceData + F 8200067C 8284DC6C 25F ( 607) XamContentGetDeviceName + F 82000680 8284DC7C 1A0 ( 416) XamEnableInactivityProcessing + F 82000684 8284DC8C 1A1 ( 417) XamResetInactivity + F 82000688 8284DC9C 2DC ( 732) XamShowMessageBoxUIEx + F 8200068C 8284DCAC 3CD ( 973) XGetLanguage + F 82000690 8284DCBC 3CB ( 971) XGetAVPack + F 82000694 8284DCCC 1A9 ( 425) XamLoaderTerminateTitle + F 82000698 8284DCDC 280 ( 640) XamGetExecutionId + F 8200069C 8284E45C 28B ( 651) XNotifyGetNext + F 820006A0 8284E44C 002 ( 2) NetDll_WSACleanup + F 820006A4 8284E43C 001 ( 1) NetDll_WSAStartup + F 820006A8 8284E46C 28A ( 650) XamNotifyCreateListener + F 820006AC 8284E42C 316 ( 790) XamSessionCreateHandle + F 820006B0 8284E41C 317 ( 791) XamSessionRefObjByHandle + F 820006B4 8284E40C 21A ( 538) XamUserWriteProfileSettings + F 820006B8 8284E3FC 219 ( 537) XamUserReadProfileSettings + F 820006BC 8284E3EC 1EA ( 490) XamAlloc + F 820006C0 8284E3DC 1EC ( 492) XamFree + F 820006C4 8284E3CC 3D1 ( 977) XGetVideoMode + F 820006C8 8284E3BC 1F4 ( 500) XMsgInProcessCall + F 820006CC 8284E3AC 1FC ( 508) XMsgStartIORequestEx + + xboxkrnl - 152 imports + Version: 0.0.4552.32 + Min Version: 0.0.4552.32 + + Total: 152 + Known: 100% (152 known, 0 unknown) + Implemented: 95% (145 implemented, 7 unimplemented) + + F 820006D4 8284E1FC 0B4 ( 180) KfReleaseSpinLock + F 820006D8 8284E20C 0B1 ( 177) KfAcquireSpinLock + F 820006DC 8284E21C 1DF ( 479) KiApcNormalRoutineNop + F 820006E0 8284E22C 1B6 ( 438) VdEnableRingBufferRPtrWriteBack + F 820006E4 8284E23C 1C3 ( 451) VdInitializeRingBuffer + F 820006E8 8284E24C 0BE ( 190) MmGetPhysicalAddress + F 820006EC 8284E25C 1D9 ( 473) VdSetSystemCommandBufferGpuIdentifierAddress + F 820006F0 8284E26C 13B ( 315) sprintf + F 820006F4 8284E27C 1B9 ( 441) VdGetCurrentDisplayGamma + V 820006F8 266 ( 614) KeCertMonitorData + F 820006FC 8284E28C 14D ( 333) _vsnprintf + V 82000700 158 ( 344) XboxKrnlVersion + F 82000704 8284E29C 1DC ( 476) VdShutdownEngines + F 82000708 8284E2AC 1CA ( 458) VdQueryVideoMode + F 8200070C 8284E2BC 1BA ( 442) VdGetCurrentDisplayInformation + F 82000710 8284E2CC 1D3 ( 467) VdSetDisplayMode + F 82000714 8284E2DC 1D5 ( 469) VdSetGraphicsInterruptCallback + F 82000718 8284E2EC 1C2 ( 450) VdInitializeEngines + F 8200071C 8284E2FC 1C6 ( 454) VdIsHSIOTrainingSucceeded + F 82000720 8284E30C 1C9 ( 457) VdQueryVideoFlags + F 82000724 8284E31C 1B1 ( 433) VdCallGraphicsNotificationRoutines + V 82000728 1C0 ( 448) VdGpuClockInMHz + F 8200072C 8284E32C 1C5 ( 453) VdInitializeScalerCommandBuffer + F 82000730 8284E33C 269 ( 617) VdRetrainEDRAM + F 82000734 8284E34C 26A ( 618) VdRetrainEDRAMWorker + V 82000738 1C1 ( 449) VdHSIOCalibrationLock + F 8200073C 8284E35C 06B ( 107) KeLockL2 + F 82000740 8284E36C 06C ( 108) KeUnlockL2 + F 82000744 8284E37C 1C7 ( 455) VdPersistDisplay + F 82000748 8284E38C 25B ( 603) VdSwap + F 8200074C 8284E39C 1BD ( 445) VdGetSystemCommandBuffer + V 82000750 1BE ( 446) VdGlobalDevice + F 82000754 8284E1EC 04D ( 77) KeAcquireSpinLockAtRaisedIrql + F 82000758 8284E1DC 089 ( 137) KeReleaseSpinLockFromRaisedIrql + F 8200075C 8284E1CC 1B4 ( 436) VdEnableDisableClockGating + F 82000760 8284E1BC 13F ( 319) RtlTimeFieldsToTime + F 82000764 8284E1AC 136 ( 310) RtlRaiseException + F 82000768 8284E19C 0EE ( 238) NtQueryVirtualMemory + F 8200076C 8284E18C 11B ( 283) RtlCompareMemoryUlong + F 82000770 8284E17C 066 ( 102) KeGetCurrentProcessType + F 82000774 8284E16C 053 ( 83) KeBugCheckEx + F 82000778 8284E15C 126 ( 294) RtlFillMemoryUlong + V 8200077C 1AE ( 430) ExLoadedCommandLine + F 82000780 8284E14C 05A ( 90) KeDelayExecutionThread + F 82000784 8284E13C 143 ( 323) RtlUnicodeToMultiByteN + F 82000788 8284E12C 0E4 ( 228) NtQueryDirectoryFile + F 8200078C 8284E10C 019 ( 25) ExTerminateThread + F 82000790 8284E0FC 09B ( 155) KeSetCurrentStackPointers + F 82000794 8284E0EC 197 ( 407) XexGetProcedureAddress + F 82000798 8284E0DC 03C ( 60) !! IoDismountVolumeByFileHandle + F 8200079C 8284E0CC 0D9 ( 217) NtDeviceIoControlFile + F 820007A0 8284E0BC 028 ( 40) HalReturnToFirmware + F 820007A4 8284E0AC 003 ( 3) DbgPrint + F 820007A8 8284E09C 140 ( 320) RtlTimeToTimeFields + F 820007AC 8284E08C 0FE ( 254) NtWaitForMultipleObjectsEx + F 820007B0 8284E07C 0F3 ( 243) NtReleaseSemaphore + F 820007B4 8284E06C 0D5 ( 213) NtCreateSemaphore + F 820007B8 8284E05C 084 ( 132) KeQuerySystemTime + F 820007BC 8284E04C 0E8 ( 232) NtQueryInformationFile + F 820007C0 8284E03C 0F7 ( 247) NtSetInformationFile + F 820007C4 8284E02C 0FD ( 253) NtWaitForSingleObjectEx + F 820007C8 8284E01C 0CE ( 206) NtClearEvent + F 820007CC 8284E00C 0F5 ( 245) NtResumeThread + V 820007D0 0AD ( 173) KeTimeStampBundle + F 820007D4 8284DFFC 010 ( 16) ExGetXConfigSetting + V 820007D8 059 ( 89) KeDebugMonitorData + F 820007DC 8284DFEC 097 ( 151) KeSetAffinityThread + F 820007E0 8284DFDC 0FC ( 252) NtSuspendThread + F 820007E4 8284DFCC 081 ( 129) KeQueryBasePriorityThread + V 820007E8 01B ( 27) ExThreadObjectType + F 820007EC 8284DFBC 110 ( 272) ObReferenceObjectByHandle + F 820007F0 8284DFAC 099 ( 153) KeSetBasePriorityThread + F 820007F4 8284DF9C 10B ( 267) ObLookupThreadByThreadId + F 820007F8 8284DF8C 10E ( 270) ObOpenObjectByPointer + F 820007FC 8284DF7C 0DA ( 218) NtDuplicateObject + F 82000800 8284DF6C 101 ( 257) NtYieldExecution + F 82000804 8284DF5C 0F6 ( 246) NtSetEvent + F 82000808 8284DF4C 052 ( 82) KeBugCheck + F 8200080C 8284DF3C 0BC ( 188) MmDeleteKernelStack + F 82000810 8284DF2C 0BB ( 187) MmCreateKernelStack + F 82000814 8284DF1C 0D1 ( 209) NtCreateEvent + F 82000818 8284DF0C 135 ( 309) RtlNtStatusToDosError + F 8200081C 8284DEFC 194 ( 404) XexCheckExecutablePrivilege + F 82000820 8284DEEC 05F ( 95) KeEnterCriticalRegion + F 82000824 8284DEDC 07D ( 125) KeLeaveCriticalRegion + F 82000828 8284DECC 0CC ( 204) NtAllocateVirtualMemory + F 8200082C 8284DEBC 259 ( 601) !! StfsCreateDevice + F 82000830 8284DEAC 103 ( 259) ObCreateSymbolicLink + F 82000834 8284DE9C 25A ( 602) !! StfsControlDevice + F 82000838 8284DE8C 0DB ( 219) NtFlushBuffersFile + F 8200083C 8284DE7C 104 ( 260) ObDeleteSymbolicLink + F 82000840 8284DE6C 105 ( 261) ObDereferenceObject + F 82000844 8284DE5C 0DC ( 220) NtFreeVirtualMemory + F 82000848 8284DE4C 0D2 ( 210) NtCreateFile + F 8200084C 8284DE3C 256 ( 598) XeKeysConsolePrivateKeySign + F 82000850 8284DE2C 0F0 ( 240) NtReadFile + F 82000854 8284DE1C 0FF ( 255) NtWriteFile + F 82000858 8284DE0C 192 ( 402) XeCryptSha + F 8200085C 8284DDFC 257 ( 599) !! XeKeysConsoleSignatureVerification + F 82000860 8284DDEC 015 ( 21) ExRegisterTitleTerminateNotification + F 82000864 8284DDDC 09D ( 157) KeSetEvent + F 82000868 8284DDCC 0B0 ( 176) KeWaitForSingleObject + F 8200086C 8284DDBC 08F ( 143) KeResetEvent + V 82000870 193 ( 403) XexExecutableModuleHandle + F 82000874 8284DDAC 12B ( 299) RtlImageXexHeaderField + F 82000878 8284DD9C 1A5 ( 421) !! __C_specific_handler + F 8200087C 8284DD8C 12C ( 300) RtlInitAnsiString + F 82000880 8284DD7C 0DF ( 223) NtOpenFile + F 82000884 8284DD6C 0CF ( 207) NtClose + F 82000888 8284DD5C 0EF ( 239) NtQueryVolumeInformationFile + F 8200088C 8284DD4C 0C4 ( 196) MmQueryAddressProtect + F 82000890 8284DD3C 0BD ( 189) MmFreePhysicalMemory + F 82000894 8284DD2C 0BA ( 186) MmAllocatePhysicalMemoryEx + F 82000898 8284DD1C 12E ( 302) RtlInitializeCriticalSection + F 8200089C 8284DD0C 130 ( 304) RtlLeaveCriticalSection + F 820008A0 8284DCFC 125 ( 293) RtlEnterCriticalSection + F 820008A4 8284DCEC 12F ( 303) RtlInitializeCriticalSectionAndSpinCount + F 820008A8 8284E11C 00D ( 13) ExCreateThread + F 820008AC 8284E47C 085 ( 133) KeRaiseIrqlToDpcLevel + F 820008B0 8284E48C 0B3 ( 179) KfLowerIrql + F 820008B4 8284E49C 088 ( 136) KeReleaseSemaphore + F 820008B8 8284E4AC 1F8 ( 504) XAudioGetVoiceCategoryVolume + F 820008BC 8284E4BC 1F7 ( 503) XAudioGetVoiceCategoryVolumeChangeMask + F 820008C0 8284E4CC 0AF ( 175) KeWaitForMultipleObjects + F 820008C4 8284E4DC 092 ( 146) KeResumeThread + F 820008C8 8284E4EC 074 ( 116) KeInitializeSemaphore + F 820008CC 8284E4FC 226 ( 550) XMAReleaseContext + F 820008D0 8284E50C 224 ( 548) XMACreateContext + F 820008D4 8284E51C 083 ( 131) KeQueryPerformanceFrequency + F 820008D8 8284E52C 141 ( 321) RtlTryEnterCriticalSection + F 820008DC 8284E53C 0AE ( 174) KeTryToAcquireSpinLockAtRaisedIrql + F 820008E0 8284E54C 1F3 ( 499) XAudioRegisterRenderDriverClient + F 820008E4 8284E55C 1F4 ( 500) XAudioUnregisterRenderDriverClient + F 820008E8 8284E56C 1F5 ( 501) XAudioSubmitRenderDriverFrame + F 820008EC 8284E57C 195 ( 405) XexGetModuleHandle + F 820008F0 8284E58C 147 ( 327) !! RtlUnwind + F 820008F4 8284E59C 152 ( 338) KeTlsAlloc + F 820008F8 8284E5AC 154 ( 340) KeTlsGetValue + F 820008FC 8284E5BC 155 ( 341) KeTlsSetValue + F 82000900 8284E5CC 153 ( 339) KeTlsFree + F 82000904 8284E5DC 119 ( 281) !! RtlCaptureContext + F 82000908 8284E5EC 05D ( 93) KeEnableFpuExceptions + F 8200090C 8284E5FC 0C6 ( 198) MmQueryStatistics + F 82000910 8284E60C 0D7 ( 215) NtCreateTimer + F 82000914 8284E61C 0FA ( 250) NtSetTimerEx + F 82000918 8284E62C 0CD ( 205) NtCancelTimer + F 8200091C 8284E63C 0E7 ( 231) NtQueryFullAttributesFile + F 82000920 8284E64C 127 ( 295) RtlFreeAnsiString + F 82000924 8284E65C 142 ( 322) RtlUnicodeStringToAnsiString + F 82000928 8284E66C 12D ( 301) RtlInitUnicodeString + F 8200092C 8284E67C 133 ( 307) RtlMultiByteToUnicodeN + F 82000930 8284E68C 001 ( 1) DbgBreakPoint + +w> 000000D4 GameDatabase: Title doesn't contain XLAST data! Multiplayer functionality might be limited. +i> 000000D4 Title name: PROJECT SYLPHEED +i> 000000D4 +-------------------- ACHIEVEMENTS -------------------- ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| ID | Title | Description | Type | Gamerscore | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 1 | Space Combat Award | Received after your first space battle in the Glasner Training Area. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 2 | Schlos Base Defense Award | Received for stopping the missile attack on Schlos Base. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 3 | Aegis of the People Medal | Received for escorting all 7 refugee ships to safety. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 4 | TCAF Luna Medal | Received for bravely helping the fleet escape during the invasion of the Matisse System. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 5 | TCAF Mars Medal | Received for bravery beyond the call of duty during the escape from the Matisse System. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 6 | Soldier's Charm Amulet | Given to you by Raymond as a token of his trust. | Event | 50 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 7 | White Griffons Patch | Received by the commander and pilots of the White Griffon Squadron when it is formed. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 8 | TCAF Jupiter Medal | Received for bravery during the enemy's attack on the Alberti System. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 9 | Furious Pursuit Badge | Received for continuing attacks on the enemy and shooting down a large number of ships. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 10 | Solo Aerospace Combat Award | Received for descending into Acheron's atmosphere and engaging in combat alone. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 11 | Operation Nebula Blaze Award | Received for completing the extremely hazardous Operation Nebula Blaze. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 12 | Guilty Roses Patch | Received for repelling the Guilty Roses Squadron. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 13 | Super Battleship Slayer Patch | Received for shooting down the second S battleship. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 14 | TCAF Terra Medal | Received for shielding the fleet and seeing that all ships safely fled the Ingres System. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 15 | Hellfires Patch | Received for repelling the enemy Hellfire Squadron. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 16 | Night Ravens Patch | Received for challenging and eradicating the Night Raven Squadron. | Event | 50 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 17 | Solar System Defense Award | Received for great achievements during the campaign to defend the Solar System. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 18 | Special Operations Medal | Received for heroically destroying the Prometheus Driver. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 19 | 1,000 Units Destroyed Medal | Received for shooting down 1,000 enemy fighters and attackers in combat. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 20 | 10,000 Units Destroyed Medal | Received for shooting down 10,000 enemy fighters and attackers in combat. | Event | 70 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 21 | Ship Hunter Award | Received for shooting down 100 enemy warships in combat. | Event | 50 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 22 | Gigaton Club Patch | Received for shooting down enemy vessels with a total weight of one gigaton. | Event | 70 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 23 | Weapon Lord Patch | Received after you collect all usable equipment for the Delta Saber. | Event | 80 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 24 | TCAF Pilot's Commendation | Commemmorates you as one of the greatest pilots in history. | Event | 100 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +i> 000000D4 +-------------------- PROPERTIES -------------------- ++----------+------------------+-------------+-----------+ +| ID | Name | Matchmaking | Data Size | ++----------+------------------+-------------+-----------+ +| 10000006 | Killed Aircrafts | False | 4 | ++----------+------------------+-------------+-----------+ +| 10000008 | Equipments | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000000A | Clear Time | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000000B | Killed Warships | False | 4 | ++----------+------------------+-------------+-----------+ +| 10008001 | Rank | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000800A | | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000800B | | False | 4 | ++----------+------------------+-------------+-----------+ +| 20000005 | Killed Weight | False | 8 | ++----------+------------------+-------------+-----------+ +| 20000007 | Clear Time | False | 8 | ++----------+------------------+-------------+-----------+ +| 20000009 | Earned Points | False | 8 | ++----------+------------------+-------------+-----------+ +| 40008002 | Gamer Name | False | 2 | ++----------+------------------+-------------+-----------+ +i> 000000D4 +-------------------- CONTEXTS -------------------- ++----------+-------------+-------------+---------------+-----------+ +| ID | Name | Matchmaking | Default Value | Max Value | ++----------+-------------+-------------+---------------+-----------+ +| 00000000 | Game Stage | False | 0 | 28 | ++----------+-------------+-------------+---------------+-----------+ +| 00000001 | Game Status | False | 0 | 9 | ++----------+-------------+-------------+---------------+-----------+ +| 00008001 | | False | 0 | 0 | ++----------+-------------+-------------+---------------+-----------+ +| 0000800A | Game Type | True | 0 | 1 | ++----------+-------------+-------------+---------------+-----------+ +| 0000800B | | True | 0 | 0 | ++----------+-------------+-------------+---------------+-----------+ +i> 000000D4 +-------------------- STATS VIEWS -------------------- ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| ID | View Type | Name | Skilled | Arbitrated | Hidden | Team View | Online Only | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000001 | Leaderboard | Time Attack (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000002 | Leaderboard | Score Attack (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000003 | Leaderboard | Extra 1 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000004 | Leaderboard | Extra 1 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000005 | Leaderboard | Extra 2 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000006 | Leaderboard | Extra 2 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000007 | Leaderboard | Extra 3 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000008 | Leaderboard | Extra 3 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000009 | Leaderboard | Extra 4 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 0000000A | Leaderboard | Extra 4 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 0000000C | Leaderboard | Time Attack (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 0000000D | Leaderboard | Score Attack (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| FFFF0000 | Leaderboard | | True | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +i> 000000D4 +-------------------- PRESENCE MODES -------------------- ++---------------+----------------+------------------+ +| Context Value | Contexts Count | Properties Count | ++---------------+----------------+------------------+ +| 0 | 2 | 0 | ++---------------+----------------+------------------+ +i> 000000D4 XThread01000020 (5) Stack: 70110000-70130000 +i> 000000D4 KernelState: Launching module... +i> 000000D4 XThreadF8000008 (6) Stack: 70150000-701D0000 +K> 01000020 XThread::Execute thid 5 (handle=01000020, 'Kernel Dispatch (01000020)', native=00000190, ) +i> 01000010 Loaded 7 shaders from storage +i> 01000010 Loaded 4 pipeline descriptions, 8 shader translations needed +K> F8000008 XThread::Execute thid 6 (handle=F8000008, 'Main XThread (F8000008)', native=00000194) +i> 01000010 Translated 7 shaders in 3 ms +i> 01000010 Pipeline cache loaded: 4 created, 0 already exist, 4 total stored +i> 01000010 Pipeline creation took 0 milliseconds +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800000C type=1 initial_state=0 lr=824A9F6C +F> F8000008 NullDevice::ResolvePath() +F> F8000008 NullDevice::ResolvePath() +F> F8000008 NullDevice::ResolvePath() +!> F8000008 undefined extern call to 8284E0DC IoDismountVolumeByFileHandle +F> F8000008 NullDevice::ResolvePath() +i> F8000008 Got xam task args: v1 = 02080002, v2 = 00000000 +i> F8000008 XThreadF8000010 (7) Stack: 701F0000-70270000 +K> F8000010 XThread::Execute thid 7 (handle=F8000010, 'XThread01B8 (F8000010)', native=000001B8) +F> F8000010 NullDevice::ResolvePath() +w> F8000010 Game is attempting to allocate devkit debug memory (base: 00000000, size: 000FF000). Ignoring debug flag and using normal allocation. +!> F8000010 undefined extern call to 8284DEBC StfsCreateDevice +K> F8000010 AUDIT-HLC KeSetEvent guest_ptr=8287094C lr=824A95D0 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000020 type=1 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000024 (8) Stack: 70290000-702B0000 +K> F8000024 XThread::Execute thid 8 (handle=F8000024, 'XThread01BC (F8000024)', native=000001BC) +K> F8000024 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000020 alertable=0 lr=824AC578 guest_lr=824AFFC4 +F> F8000008 HostPathDevice::ResolvePath() +i> F8000008 XThreadF800002C (9) Stack: 702D0000-702E0000 +K> F800002C XThread::Execute thid 9 (handle=F800002C, 'XThread01C0 (F800002C)', native=000001C0) +F> F800002C HostPathDevice::ResolvePath() +F> F800002C HostPathDevice::ResolvePath() +F> F8000008 HostPathDevice::ResolvePath(\d4ea4615\e\46ee8ca) +F> F8000008 HostPathDevice::ResolvePath(\d4ea4615\e) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800003C type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000040 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000048 (A) Stack: 70300000-70340000 +K> F8000048 XThread::Execute thid 10 (handle=F8000048, 'XThread01C4 (F8000048)', native=000001C4) +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800003C alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000050 type=0 initial_state=0 lr=824A9F6C +!> F800002C BaseHeap::Release failed because address is not a region start +!> F800002C PhysicalHeap::Release failed due to parent heap failure +F> F800002C HostPathDevice::ResolvePath() +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +F> F800002C HostPathDevice::ResolvePath() +K> F8000048 AUDIT-HLC NtSetEvent handle=F800004C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800003C result=00000000 lr=824AC578 guest_lr=82452E64 +!> F800002C BaseHeap::Release failed because address is not a region start +!> F800002C PhysicalHeap::Release failed due to parent heap failure +K> F800002C AUDIT-HLC NtWaitForSingleObjectEx handle=F8000028 alertable=0 lr=824AC578 guest_lr=824AFFC4 +!> F8000008 BaseHeap::Release failed because address is not a region start +!> F8000008 PhysicalHeap::Release failed due to parent heap failure +!> F8000008 BaseHeap::Release failed because address is not a region start +!> F8000008 PhysicalHeap::Release failed due to parent heap failure +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\8\3421153) +F> F8000008 DiscImageDevice::ResolvePath(\dat) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\355f2f8) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000038 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800004C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800004C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000050 type=0 initial_state=0 lr=824A9F6C +i> F8000048 XThreadF8000058 (B) Stack: 70360000-70370000 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F800004C alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 XThread::Execute thid 11 (handle=F8000058, 'XThread01C8 (F8000058)', native=000001C8) +K> F8000058 AUDIT-HLC NtSetEvent handle=F800004C lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800004C result=00000000 lr=824AC578 guest_lr=8245148C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F800003C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=82452E64 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000038 type=1 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF800004C (C) Stack: 70390000-703A0000 +K> F800004C XThread::Execute thid 12 (handle=F800004C, 'XThread01CC (F800004C)', native=000001CC) +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +i> F8000008 Hardware scaler: width ratio 1:1, height ratio 1:1, final aspect ratio 16:9 +i> 01000010 Selecting rep movs vastcpy. +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000060 type=1 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000064 type=1 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000068 (D) Stack: 703C0000-70440000 +K> F8000068 XThread::Execute thid 13 (handle=F8000068, 'XThread01D0 (F8000068)', native=000001D0) +F> F8000008 HostPathDevice::ResolvePath(\aab216c3\a\2c8c185) +F> F8000008 HostPathDevice::ResolvePath(\aab216c3\a) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000070 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000070 alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000078 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 AUDIT-HLC NtSetEvent handle=F8000078 lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000078 result=00000000 lr=824AC578 guest_lr=8245148C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000074 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000070 result=00000000 lr=824AC578 guest_lr=82452E64 +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\73a5c0a) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000070 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000070 alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000078 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 AUDIT-HLC NtSetEvent handle=F8000078 lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000078 result=00000000 lr=824AC578 guest_lr=8245148C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000074 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000070 result=00000000 lr=824AC578 guest_lr=82452E64 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +i> F8000008 XThreadF8000070 (E) Stack: 70460000-704E0000 +i> F8000008 XThreadF8000074 (F) Stack: 70500000-70580000 +K> F8000070 XThread::Execute thid 14 (handle=F8000070, 'XThread01D4 (F8000070)', native=000001D4) +K> F8000074 XThread::Execute thid 15 (handle=F8000074, 'XThread01D8 (F8000074)', native=000001D8) +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +i> F8000008 AudioSystem::RegisterClient: driver created for index=0, driver=0x70c389000040 +i> F8000008 AudioSystem::RegisterClient: client 0 registered successfully +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000088 type=0 initial_state=0 lr=824A9F6C +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\39a9dcc) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000088 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000090 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000088 result=00000000 lr=824AC578 guest_lr=8245FA10 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000088 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +F> F8000008 DiscImageDevice::ResolvePath(\dat) +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000090 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000088 alertable=0 lr=824AC578 guest_lr=82460150 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000088 result=00000000 lr=824AC578 guest_lr=82460150 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000088 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000088 alertable=0 lr=824AC578 guest_lr=82179148 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000090 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000088 result=00000000 lr=824AC578 guest_lr=82179148 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +i> F8000008 XThreadF8000088 (10) Stack: 705A0000-705B0000 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000088 XThread::Execute thid 16 (handle=F8000088, 'XThread01EC (F8000088)', native=000001EC) +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000090 alertable=0 lr=824AC578 guest_lr=82173BD4 +K> F8000068 AUDIT-HLC NtSetEvent handle=F8000090 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000090 result=00000000 lr=824AC578 guest_lr=82173BD4 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000094 (11) Stack: 705D0000-70650000 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000094 alertable=0 lr=824AC578 guest_lr=822F1B50 +K> F8000094 XThread::Execute thid 17 (handle=F8000094, 'XThread01F0 (F8000094)', native=000001F0) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000094 AUDIT-HLC NtCreateEvent handle=F8000098 type=1 initial_state=1 lr=824A9F6C +K> F8000094 AUDIT-HLC NtCreateEvent handle=F800009C type=0 initial_state=0 lr=824A9F6C +F> F8000094 HostPathDevice::ResolvePath(\aab216c3\5\ee70e0a) +F> F8000094 HostPathDevice::ResolvePath(\aab216c3\5) +K> F8000094 AUDIT-HLC NtWaitForSingleObjectEx handle=F800009C alertable=0 lr=824AC578 guest_lr=821CBAE0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000A8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A8 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 AUDIT-HLC NtSetEvent handle=F80000A8 lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000A8 result=00000000 lr=824AC578 guest_lr=8245148C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000A4 lr=824AA304 +K> F8000094 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800009C result=00000000 lr=824AC578 guest_lr=821CBAE0 +i> F8000094 XThreadF800009C (12) Stack: 70670000-70680000 +K> F800009C XThread::Execute thid 18 (handle=F800009C, 'XThread01F4 (F800009C)', native=000001F4) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +i> F800009C XThreadF80000A4 (13) Stack: 706A0000-706D0000 +i> F800009C XThreadF80000A8 (14) Stack: 706F0000-70720000 +K> F80000A4 XThread::Execute thid 19 (handle=F80000A4, 'XThread01F8 (F80000A4)', native=000001F8) +K> F80000A8 XThread::Execute thid 20 (handle=F80000A8, 'XThread01FC (F80000A8)', native=000001FC) +K> F80000A8 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A0 alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F80000A4 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A0 alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000094 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +F> F8000094 HostPathDevice::ResolvePath(\87719002\c\dba806e) +F> F8000094 HostPathDevice::ResolvePath(\87719002\c) +K> F8000094 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +F> F8000094 HostPathDevice::ResolvePath(\87719002\c\ec0a96e) +F> F8000094 HostPathDevice::ResolvePath(\87719002\c) +K> F8000094 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +F> F8000094 HostPathDevice::ResolvePath(\87719002\a\60fcb85) +F> F8000094 HostPathDevice::ResolvePath(\87719002\a) +K> F8000094 AUDIT-HLC NtCreateEvent handle=F80000D0 type=0 initial_state=0 lr=824A9F6C +F> F800009C DiscImageDevice::ResolvePath(\hidden\Resource3D) +F> F8000094 HostPathDevice::ResolvePath(\87719002\2\85d8849) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +F> F8000094 HostPathDevice::ResolvePath(\87719002\2) +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800009C AUDIT-HLC NtCreateEvent handle=F80000E0 type=1 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=822DFCC8 +K> F8000094 AUDIT-HLC NtCreateEvent handle=F80000E8 type=0 initial_state=0 lr=824A9F6C +F> F8000094 HostPathDevice::ResolvePath(\87719002\a\715f485) +F> F8000094 HostPathDevice::ResolvePath(\87719002\a) +K> F8000094 AUDIT-HLC NtCreateEvent handle=F80000F4 type=0 initial_state=0 lr=824A9F6C +F> F8000094 HostPathDevice::ResolvePath(\87719002\c\f2a8ccd) +F> F8000094 HostPathDevice::ResolvePath(\87719002\c) +K> F8000094 AUDIT-HLC NtCreateEvent handle=F8000100 type=0 initial_state=0 lr=824A9F6C +F> F8000094 HostPathDevice::ResolvePath(\87719002\0\1a2db9c) +F> F8000094 HostPathDevice::ResolvePath(\87719002\0) +K> F8000094 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E8 alertable=0 lr=824AC578 guest_lr=821C515C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000B4 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000C0 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000CC lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000DC lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000E4 lr=824AA304 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=822DFCC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=822DFE24 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000F0 lr=824AA304 +K> F8000094 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E8 result=00000000 lr=824AC578 guest_lr=821C515C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000FC lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000094 result=00000000 lr=824AC578 guest_lr=822F1B50 +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000108 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000B4 lr=824AA304 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=822DFE24 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=822DFED0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000094 (15) Stack: 705D0000-705E0000 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000094 XThread::Execute thid 21 (handle=F8000094, 'XThread0200 (F8000094)', native=00000200) +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000090 lr=824AA304 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=822DFED0 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000090 type=1 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +i> F8000008 XThreadF80000BC (16) Stack: 70600000-70610000 +K> F80000BC XThread::Execute thid 22 (handle=F80000BC, 'XThread0204 (F80000BC)', native=00000204) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000C8 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C8 alertable=0 lr=824AC578 guest_lr=82172BC8 +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000C8 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C8 result=00000000 lr=824AC578 guest_lr=82172BC8 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F80000BC AUDIT-HLC NtWaitForSingleObjectEx handle=F8000090 alertable=0 lr=824AC578 guest_lr=824AFFC4 +F> F800009C DiscImageDevice::ResolvePath(\hidden\Resource3D) +K> F800009C AUDIT-HLC NtCreateEvent handle=F80000CC type=1 initial_state=0 lr=824A9F6C +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx handle=F80000CC alertable=0 lr=824AC578 guest_lr=822DFCC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D4 lr=824AA304 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000CC result=00000000 lr=824AC578 guest_lr=822DFCC8 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx handle=F80000CC alertable=0 lr=824AC578 guest_lr=822DFE24 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D4 lr=824AA304 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000CC result=00000000 lr=824AC578 guest_lr=822DFE24 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx handle=F80000CC alertable=0 lr=824AC578 guest_lr=822DFED0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000E4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF80000DC (17) Stack: 70630000-70640000 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F80000DC XThread::Execute thid 23 (handle=F80000DC, 'XThread0208 (F80000DC)', native=00000208) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000F0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF80000F8 (18) Stack: 70740000-707C0000 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000108 (19) Stack: 707E0000-70860000 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F80000F8 XThread::Execute thid 24 (handle=F80000F8, 'XThread020C (F80000F8)', native=0000020C) +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000108 XThread::Execute thid 25 (handle=F8000108, 'XThread0210 (F8000108)', native=00000210) +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D4 lr=824AA304 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000CC result=00000000 lr=824AC578 guest_lr=822DFED0 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +F> F800009C DiscImageDevice::ResolvePath(\hidden\Resource3D) +K> F800009C AUDIT-HLC NtCreateEvent handle=F80000CC type=1 initial_state=0 lr=824A9F6C +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx handle=F80000CC alertable=0 lr=824AC578 guest_lr=822DFCC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D4 lr=824AA304 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000CC result=00000000 lr=824AC578 guest_lr=822DFCC8 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx handle=F80000CC alertable=0 lr=824AC578 guest_lr=822DFE24 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000AC alertable=0 lr=824AC578 guest_lr=821CC19C +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000AC lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000AC result=00000000 lr=824AC578 guest_lr=821CC19C +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D4 lr=824AA304 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000CC result=00000000 lr=824AC578 guest_lr=822DFE24 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx handle=F80000CC alertable=0 lr=824AC578 guest_lr=822DFED0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000AC lr=824AA304 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000CC result=00000000 lr=824AC578 guest_lr=822DFED0 +F> F800009C HostPathDevice::ResolvePath(\69d8e45c\f\ca5c62e) +K> F800009C AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +F> F800009C HostPathDevice::ResolvePath(\69d8e45c\d\14ba3f8) +F> F800009C HostPathDevice::ResolvePath(\69d8e45c\d) +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx handle=F80000AC alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000CC type=0 initial_state=0 lr=824A9F6C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000CC lr=824AA304 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000AC result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F800009C HostPathDevice::ResolvePath(\69d8e45c\8\14c242d) +K> F800009C AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +F> F800009C HostPathDevice::ResolvePath(\69d8e45c\5\6324af0) +F> F800009C HostPathDevice::ResolvePath(\69d8e45c\5) +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx handle=F80000AC alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000CC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000CC lr=824AA304 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000AC result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F800009C HostPathDevice::ResolvePath(\69d8e45c\d\70a9531) +K> F800009C AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +F> F800009C HostPathDevice::ResolvePath(\69d8e45c\a\c9606f9) +F> F800009C HostPathDevice::ResolvePath(\69d8e45c\a) +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx handle=F80000AC alertable=0 lr=824AC578 guest_lr=8245FA10 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000CC type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000CC lr=824AA304 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000AC result=00000000 lr=824AC578 guest_lr=8245FA10 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +F> F800009C HostPathDevice::ResolvePath(\69d8e45c\7\9f2d535) +K> F800009C AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +F> F800009C HostPathDevice::ResolvePath(\69d8e45c\4\efaecd1) +F> F800009C HostPathDevice::ResolvePath(\69d8e45c\4) +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx handle=F80000AC alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000CC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000CC lr=824AA304 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000AC result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F800009C HostPathDevice::ResolvePath(\69d8e45c\7\0c3bba2) +K> F800009C AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +F> F800009C HostPathDevice::ResolvePath(\69d8e45c\4\59fbfe8) +F> F800009C HostPathDevice::ResolvePath(\69d8e45c\4) +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx handle=F80000AC alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000CC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000CC lr=824AA304 +K> F800009C AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000AC result=00000000 lr=824AC578 guest_lr=8245FA10 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000098 alertable=0 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000098 result=00000000 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000098 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B8 alertable=0 lr=824AC578 guest_lr=821CC19C +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000B8 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B8 result=00000000 lr=824AC578 guest_lr=821CC19C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000098 alertable=0 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000098 result=00000000 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000098 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF80000CC (1A) Stack: 70880000-70900000 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F80000CC XThread::Execute thid 26 (handle=F80000CC, 'XThread0214 (F80000CC)', native=00000214) +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F80000CC AUDIT-HLC NtCreateEvent handle=F80000D4 type=1 initial_state=1 lr=824A9F6C +K> F80000CC AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +F> F80000CC HostPathDevice::ResolvePath(\aab216c3\5\c10eae6) +F> F80000CC HostPathDevice::ResolvePath(\aab216c3\5) +K> F80000CC AUDIT-HLC NtWaitForSingleObjectEx handle=F8000104 alertable=0 lr=824AC578 guest_lr=821CBAE0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000114 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 AUDIT-HLC NtSetEvent handle=F8000114 lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000114 result=00000000 lr=824AC578 guest_lr=8245148C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000110 lr=824AA304 +K> F80000CC AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000104 result=00000000 lr=824AC578 guest_lr=821CBAE0 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000088 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +F> F8000088 DiscImageDevice::ResolvePath(\dat) +K> F8000088 AUDIT-HLC NtSetEvent handle=F8000114 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800010C alertable=0 lr=824AC578 guest_lr=82460150 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800010C result=00000000 lr=824AC578 guest_lr=82460150 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B8 alertable=0 lr=824AC578 guest_lr=82172BC8 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000B8 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B8 result=00000000 lr=824AC578 guest_lr=82172BC8 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +F> F8000008 DiscImageDevice::ResolvePath(\dat\movie) +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800010C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000118 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800011C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000120 type=0 initial_state=1 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000124 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000128 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800012C type=0 initial_state=1 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +F> F8000008 DiscImageDevice::ResolvePath(\dat\movie) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000134 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000138 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800013C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000140 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000144 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000148 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800014C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000150 type=0 initial_state=1 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +i> F8000008 XThreadF8000154 (1B) Stack: 70880000-70890000 +i> F8000008 XThreadF8000158 (1C) Stack: 708B0000-708C0000 +i> F8000008 XThreadF800015C (1D) Stack: 708E0000-708F0000 +i> F8000008 XThreadF8000160 (1E) Stack: 70910000-70920000 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25404 lr=82507ABC +K> F8000154 XThread::Execute thid 27 (handle=F8000154, 'XThread0218 (F8000154)', native=00000218) +K> F8000158 XThread::Execute thid 28 (handle=F8000158, 'XThread021C (F8000158)', native=0000021C) +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C XThread::Execute thid 29 (handle=F800015C, 'XThread0220 (F800015C)', native=00000220) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000154 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 diff --git a/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.stdout.sub821B55D8 b/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.stdout.sub821B55D8 new file mode 100644 index 0000000..82d06e7 --- /dev/null +++ b/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.stdout.sub821B55D8 @@ -0,0 +1,36551 @@ +i> 000000D8 Build: canary_experimental@99fd19d02 on Jun 5 2026 +i> 000000D8 Storage root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug +i> 000000D8 ----------- CONFIG DUMP ----------- + +[APU] +apu = "any" +apu_max_queued_frames = 8 +enable_xmp = true +ffmpeg_verbose = false +mute = false +use_dedicated_xma_thread = true +xma_decoder = "new" + +[Auditing] +audit_handle_lifecycle = true +audit_jit_prolog_pc = 2182829528 + +[CPU] +break_condition_gpr = -1 +break_condition_op = "eq" +break_condition_truncate = true +break_condition_value = 0 +break_on_debugbreak = true +break_on_instruction = 0 +break_on_start = false +break_on_unimplemented_instructions = true +clock_no_scaling = false +clock_source_raw = false +cpu = "any" +debug_symbol_loader = false +debugprint_trap_log = false +disable_context_promotion = false +disable_instruction_infocache = false +disable_prefetch_and_cachecontrol = true +disassemble_functions = false +dump_translated_hir_functions = false +elide_e0_check = false +emit_inline_mmio_checks = false +emit_mmio_aware_stores_for_recorded_exception_addresses = true +emit_source_annotations = false +enable_early_precompilation = false +full_optimization_even_with_debug = false +ignore_trap_instructions = true +ignore_undefined_externs = true +inline_loadclock = false +inline_mmio_access = true +load_module_map = "" +no_reserved_ops = false +no_round_to_single = false +permit_float_constant_evaluation = false +pvr = 7407360 +record_mmio_access_exceptions = true +store_all_context_values = false +trace_function_coverage = false +trace_function_data = false +trace_function_data_path = "" +trace_function_references = false +trace_functions = false +use_fast_dot_product = false +validate_hir = false +writable_code_segments = false + +[Config] +defaults_date = 2026040912 + +[Content] +license_mask = 0 + +[D3D12] +d3d12_adapter = -1 +d3d12_allow_variable_refresh_rate_and_tearing = true +d3d12_bindless = true +d3d12_break_on_error = false +d3d12_break_on_warning = false +d3d12_debug = false +d3d12_dxbc_disasm = false +d3d12_dxbc_disasm_dxilconv = false +d3d12_pipeline_creation_threads = -1 +d3d12_queue_priority = 1 +d3d12_submit_on_primary_buffer_end = true +d3d12_tessellation_wireframe = false + +[Display] +fullscreen = false +host_present_from_non_ui_thread = true +postprocess_antialiasing = "" +postprocess_dither = true +postprocess_ffx_cas_additional_sharpness = 0 +postprocess_ffx_fsr_max_upsampling_passes = 4 +postprocess_ffx_fsr_sharpness_reduction = 0.20000000298023224 +postprocess_scaling_and_sharpening = "" +present_letterbox = true +present_render_pass_clear = true +present_safe_area_x = 100 +present_safe_area_y = 100 + +[GPU] +anisotropic_override = -1 +async_shader_compilation = true +clear_memory_page_state = false +depth_float24_convert_in_pixel_shader = false +depth_float24_round = false +depth_transfer_not_equal_test = true +disassemble_pm4 = false +draw_resolution_scale_x = 1 +draw_resolution_scale_y = 1 +draw_resolution_scaled_texture_offsets = true +dump_shaders = "" +dxbc_source_map = false +dxbc_switch = true +execute_unclipped_draw_vs_on_cpu = true +execute_unclipped_draw_vs_on_cpu_for_psi_render_backend = true +execute_unclipped_draw_vs_on_cpu_with_scissor = false +force_convert_line_loops_to_strips = false +force_convert_quad_lists_to_triangle_lists = false +force_convert_triangle_fans_to_lists = false +framerate_limit = 0 +gamma_render_target_as_unorm16 = true +gpu = "any" +gpu_3d_to_2d_texture = true +gpu_allow_invalid_fetch_constants = true +gpu_allow_invalid_upload_range = false +half_pixel_offset = true +ignore_32bit_vertex_index_support = false +log_guest_driven_gpu_register_written_values = false +log_ringbuffer_kickoff_initiator_bts = false +mrt_edram_used_range_clamp_to_min = true +native_2x_msaa = true +native_stencil_value_output = true +native_stencil_value_output_d3d12_intel = false +no_discard_stencil_in_transfer_pipelines = false +non_seamless_cube_map = true +occlusion_query = "fast" +occlusion_query_fake_lower_threshold = 80 +occlusion_query_fake_upper_threshold = 100 +occlusion_query_querybatch_range = 0 +occlusion_query_saturation = 1 +primitive_processor_cache_min_indices = 4096 +readback_memexport = false +readback_resolve = "none" +render_target_path_d3d12 = "" +render_target_path_vulkan = "" +resolve_resolution_scale_fill_half_pixel_offset = true +snorm16_render_target_full_range = true +store_shaders = true +target_trace_file = "" +texture_cache_memory_limit_hard = 768 +texture_cache_memory_limit_render_to_texture = 24 +texture_cache_memory_limit_soft = 384 +texture_cache_memory_limit_soft_lifetime = 30 +tiled_shared_memory = true +trace_dump_path = "" +trace_gpu_prefix = "scratch/gpu/" +trace_gpu_stream = false +use_fuzzy_alpha_epsilon = false +vsync = true + +[General] +allow_game_relative_writes = false +allow_plugins = false +apply_patches = true +controller_hotkeys = false +debug = false +disable_doubleclick_fullscreen = false +discord = true +launch_module = "" +notification_sound_path = "" +priority_class = 0 +recent_titles_entry_amount = 10 +time_scalar = 1 + +[HACKS] +ac6_ground_fix = false + +[HID] +guide_button = true +hid = "any" +keyboard_mode = 0 +keyboard_user_index = 0 +left_stick_deadzone_percentage = 0 +right_stick_deadzone_percentage = 0 +vibration = true + +[HID.WinKey] +keybind_a = "0xBA" +keybind_b = "0xDE" +keybind_back = "Z" +keybind_dpad_down = "^S" +keybind_dpad_left = "^A" +keybind_dpad_right = "^D" +keybind_dpad_up = "^W" +keybind_guide = "0x08" +keybind_left_shoulder = "1" +keybind_left_thumb = "F" +keybind_left_thumb_down = "_S" +keybind_left_thumb_left = "_A" +keybind_left_thumb_right = "_D" +keybind_left_thumb_up = "_W" +keybind_left_trigger = "Q I" +keybind_right_shoulder = "3" +keybind_right_thumb = "K" +keybind_right_thumb_down = "0x28" +keybind_right_thumb_left = "0x25" +keybind_right_thumb_right = "0x27" +keybind_right_thumb_up = "0x26" +keybind_right_trigger = "E O" +keybind_start = "X" +keybind_x = "L" +keybind_y = "P" + +[Kernel] +allow_avatar_initialization = false +allow_incompatible_title_update = true +apply_title_update = true +cl = "" +console_type = 0 +default_achievements_backend = "GPD" +ignore_thread_affinities = true +ignore_thread_priorities = false +kernel_build_version = 1888 +kernel_cert_monitor = false +kernel_debug_monitor = false +kernel_display_gamma_power = 2.22222233 +kernel_display_gamma_type = 2 +kernel_pix = false +staging_mode = false + +[Logging] +enable_console = false +flush_log = true +log_file = "" +log_high_frequency_kernel_calls = false +log_level = 2 +log_mask = 0 +log_string_format_kernel_calls = false +log_to_debugprint = false +log_to_stdout = true + +[Memory] +ignore_offset_for_ranged_allocations = false +protect_on_release = false +protect_zero = true +scribble_heap = false +scribble_heap_value = 0 +writable_executable_memory = true + +[Profiles] +logged_profile_slot_0_xuid = "" +logged_profile_slot_1_xuid = "" +logged_profile_slot_2_xuid = "" +logged_profile_slot_3_xuid = "" + +[SDL] +mappings_file = "gamecontrollerdb.txt" + +[Storage] +cache_root = "" +content_root = "" +force_mount_devkit = false +mount_cache = true +mount_memory_unit = false +mount_scratch = false +storage_root = "" + +[UI] +custom_font_path = "" +font_size = 14 +headless = false +imgui_debug = false +profiler_dpi_scaling = false +show_achievement_notification = false +show_profiler = false +storage_selection_dialog = false +window_size_x = 1280 +window_size_y = 720 + +[Video] +avpack = 8 +custom_internal_display_resolution_x = 0 +custom_internal_display_resolution_y = 0 +enable_3d_mode = false +interlaced = false + +[Vulkan] +vulkan_allow_present_mode_fifo_relaxed = true +vulkan_allow_present_mode_immediate = true +vulkan_allow_present_mode_mailbox = true +vulkan_device = -1 +vulkan_log_debug_messages = true +vulkan_pipeline_creation_threads = -1 +vulkan_semaphore_reuse_workaround = false +vulkan_sparse_shared_memory = true +vulkan_validation = false + +[Win32] +win32_high_resolution_timer = true +win32_mmcss = true + +[x64] +align_all_basic_blocks = 0 +delay_via_maybeyield = false +enable_host_guest_stack_synchronization = true +enable_incorrect_roundingmode_behavior = false +enable_rmw_context_merging = false +instrument_call_times = false +max_stackpoints = 65536 +x64_extension_mask = -1 +xop_arithmetic_right_shifts = false +xop_compares = true +xop_left_shifts = false +xop_right_shifts = false +xop_rotates = false +----------- END OF CONFIG DUMP ---- +i> 000000D8 Loaded config: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\xenia-canary.config.toml +i> 000000D8 Content root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\content +i> 000000D8 Host cache root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\cache_host +w> 000000D8 Unable to load Japanese font; JP characters will be boxes +w> 000000D8 Unable to load Japanese font; JP characters will be boxes +i> 00000128 Setup: Initializing Memory... +i> 00000128 Setup: Initializing Exports... +i> 00000128 Setup: Initializing Processor... +i> 00000128 Setup: Initializing Audio... +i> 00000128 Setup: Initializing Graphics... +i> 00000128 Setup: Initializing HID... +i> 00000128 winkey: "0x08" binds key 0x8 to controller input GUIDE. +i> 00000128 winkey: "^A" binds key 0x41 to controller input DPAD_LEFT. +i> 00000128 winkey: "^D" binds key 0x44 to controller input DPAD_RIGHT. +i> 00000128 winkey: "^S" binds key 0x53 to controller input DPAD_DOWN. +i> 00000128 winkey: "^W" binds key 0x57 to controller input DPAD_UP. +i> 00000128 winkey: "_A" binds key 0x41 to controller input LEFT_THUMB_LEFT. +i> 00000128 winkey: "_D" binds key 0x44 to controller input LEFT_THUMB_RIGHT. +i> 00000128 winkey: "_S" binds key 0x53 to controller input LEFT_THUMB_DOWN. +i> 00000128 winkey: "_W" binds key 0x57 to controller input LEFT_THUMB_UP. +i> 00000128 winkey: "F" binds key 0x46 to controller input LEFT_THUMB_PRESSED. +i> 00000128 winkey: "0x26" binds key 0x26 to controller input RIGHT_THUMB_UP. +i> 00000128 winkey: "0x28" binds key 0x28 to controller input RIGHT_THUMB_DOWN. +i> 00000128 winkey: "0x27" binds key 0x27 to controller input RIGHT_THUMB_RIGHT. +i> 00000128 winkey: "0x25" binds key 0x25 to controller input RIGHT_THUMB_LEFT. +i> 00000128 winkey: "K" binds key 0x4B to controller input RIGHT_THUMB_PRESSED. +i> 00000128 winkey: "L" binds key 0x4C to controller input X. +i> 00000128 winkey: "0xDE" binds key 0xDE to controller input B. +i> 00000128 winkey: "0xBA" binds key 0xBA to controller input A. +i> 00000128 winkey: "P" binds key 0x50 to controller input Y. +i> 00000128 winkey: "Q" binds key 0x51 to controller input LEFT_TRIGGER. +i> 00000128 winkey: "I" binds key 0x49 to controller input LEFT_TRIGGER. +i> 00000128 winkey: "E" binds key 0x45 to controller input RIGHT_TRIGGER. +i> 00000128 winkey: "O" binds key 0x4F to controller input RIGHT_TRIGGER. +i> 00000128 winkey: "Z" binds key 0x5A to controller input BACK. +i> 00000128 winkey: "X" binds key 0x58 to controller input START. +i> 00000128 winkey: "1" binds key 0x31 to controller input LEFT_SHOULDER. +i> 00000128 winkey: "3" binds key 0x33 to controller input RIGHT_SHOULDER. +i> 000000D8 SDL Version 2.32.2 initialized. +w> 000000D8 SDL GameControllerDB: file 'gamecontrollerdb.txt' does not exist. +i> 00000128 Setup: Initializing VFS... +i> 00000128 PatchDB: Loaded patches for 0 titles +i> 00000128 Setup: Initializing Kernel... +i> 00000128 ProfileManager: Found 0 Profiles +w> 00000128 BaseHeap::AllocFixed attempting commit on unreserved page +w> 00000128 BaseHeap::AllocFixed attempting commit on unreserved page +i> 00000128 Setup: Starting graphics_system... +i> 00000128 DXGI adapter: NVIDIA GeForce GTX 1070 Ti (vendor 0x1002, device 0x73DF) +i> 00000128 Direct3D 12 device and OS features: +* Max GPU virtual address bits per resource: 40 +* Non-zeroed heap creation: yes +* Pixel-shader-specified stencil reference: no +* Programmable sample positions: tier 0 +* Rasterizer-ordered views: yes +* Resource binding: tier 3 +* Tiled resources: tier 4 +* Unaligned block-compressed textures: yes +i> 00000128 XThread01000010 (1) Stack: 70010000-70030000 +i> 00000128 XThread01000014 (2) Stack: 70050000-70070000 +i> 00000128 Setup: Starting audio_system... +K> 01000010 XThread::Execute thid 1 (handle=01000010, 'GPU Commands (01000010)', native=00000158, ) +K> 01000014 XThread::Execute thid 2 (handle=01000014, 'GPU Frame limiter (01000014)', native=0000015C, ) +i> 00000128 XThread01000018 (3) Stack: 70090000-700B0000 +i> 00000128 XThread0100001C (4) Stack: 700D0000-700F0000 +K> 01000018 XThread::Execute thid 3 (handle=01000018, 'XMA Decoder (01000018)', native=00000184, ) +K> 0100001C XThread::Execute thid 4 (handle=0100001C, 'Audio Worker (0100001C)', native=00000188, ) +i> 000000D8 Checking for XISO +F> 000000D8 DiscImageDevice::Initialize +i> 000000D8 Checking for XISO +F> 000000D8 DiscImageDevice::Initialize +F> 000000D8 DiscImageDevice::Initialize +i> 000000D8 Loading module GAME:\default.xex +F> 000000D8 DiscImageDevice::ResolvePath(\default.xex) +i> 000000D8 Module \Device\Cdrom0\default.xex: +Module Hash: CCF935D24A74E002 + Module Flags: 00000001 + XEX_MODULE_TITLE +Security Header: + Image Flags: 00000008 + XEX_IMAGE_XGD2_MEDIA_ONLY + Load Address: 82000000 + Image Size: 00920000 + Export Table: 00000000 +Optional Header Count: 15 + XEX_HEADER_RESOURCE_INFO: + 535107D4 828FB900-8291D8CF, 139215b + XEX_HEADER_FILE_FORMAT_INFO: + Info Size: 36 + Encryption Type: Normal + Compression Type: Normal + Window Size: 32768 + Block Size: 61440 + Block Hash: B3 2B D7 D4 EF 96 9A C5 9F D7 77 C6 8A 99 AA 1C BD 87 1C BE 00 90 2E F1 46 3F A3 D7 00 00 00 10 + XEX_HEADER_ENTRY_POINT: 824AB748 + XEX_HEADER_IMAGE_BASE_ADDRESS: 82000000 + XEX_HEADER_IMPORT_LIBRARIES: + xam.xex - 104 imports + Version: 2.0.4552.0 + Min Version: 2.0.4552.0 + xboxkrnl.exe - 294 imports + Version: 2.0.4552.0 + Min Version: 2.0.4552.0 + XEX_HEADER_CHECKSUM_TIMESTAMP: + Checksum : 00902EF1 + Time Stamp: 463FA3D7 - Tue May 8 00:10:31 2007 + XEX_HEADER_ORIGINAL_PE_NAME: default.pe + XEX_HEADER_STATIC_LIBRARIES: + XAPILIB : 2.0.3215.0 + D3D9 : 2.0.3215.1 + D3DX9 : 2.0.3215.0 + XBOXKRNL : 2.0.3215.0 + XAUD : 2.0.3215.0 + LIBCPMT : 2.0.3215.0 + XMP : 2.0.3215.0 + XMEDIA : 2.0.3215.0 + XONLINE : 2.0.3215.0 + XGRAPHC : 2.0.3215.0 + X3DAUD : 2.0.3215.1 + XACT : 2.0.3215.1 + XEX_HEADER_TLS_INFO: + Slot Count: 64 + Raw Data Address: 00000000 + Data Size: 0 + Raw Data Size: 0 + XEX_HEADER_DEFAULT_STACK_SIZE: 524288 + XEX_HEADER_SYSTEM_FLAGS: 00000400 + XEX_SYSTEM_PAL50_INCOMPATIBLE + XEX_HEADER_EXECUTION_INFO: + Media ID: 2D2E2EEB + Title ID: 535107D4 + Savegame ID: 535107D4 + Disc Number / Total: 1 / 1 + XEX_HEADER_GAME_RATINGS: + ESRB: Teen + PEGI: 12+ + PEGI-FI: 11+ + PEGI - PT: 12+ + BBFC: 12+ + CERO: Unrated + USK: Approved for children aged 12 and above + OFLC - AU: Parental Guidance + OFLC - NZ: Parental Guidance + KMRB: Unrated + Brazil: Unrated + FPB: 13+ + XEX_HEADER_LAN_KEY: E0 3C EA 47 3C AE 06 62 98 8F DB 7F 58 50 12 38 + XEX_HEADER_XBOX360_LOGO: + Section Size: 1736 + Logo Size: 1728 +Sections: + 0 RODATA 1 pages 82000000 - 82010000 (65536 bytes) + 1 RODATA 1 pages 82010000 - 82020000 (65536 bytes) + 2 RODATA 1 pages 82020000 - 82030000 (65536 bytes) + 3 RODATA 1 pages 82030000 - 82040000 (65536 bytes) + 4 RODATA 1 pages 82040000 - 82050000 (65536 bytes) + 5 RODATA 1 pages 82050000 - 82060000 (65536 bytes) + 6 RODATA 1 pages 82060000 - 82070000 (65536 bytes) + 7 RODATA 1 pages 82070000 - 82080000 (65536 bytes) + 8 RODATA 1 pages 82080000 - 82090000 (65536 bytes) + 9 RODATA 1 pages 82090000 - 820A0000 (65536 bytes) + 10 RODATA 1 pages 820A0000 - 820B0000 (65536 bytes) + 11 RODATA 1 pages 820B0000 - 820C0000 (65536 bytes) + 12 RODATA 1 pages 820C0000 - 820D0000 (65536 bytes) + 13 RODATA 1 pages 820D0000 - 820E0000 (65536 bytes) + 14 RODATA 1 pages 820E0000 - 820F0000 (65536 bytes) + 15 RODATA 1 pages 820F0000 - 82100000 (65536 bytes) + 16 RODATA 1 pages 82100000 - 82110000 (65536 bytes) + 17 RODATA 1 pages 82110000 - 82120000 (65536 bytes) + 18 RODATA 1 pages 82120000 - 82130000 (65536 bytes) + 19 RODATA 1 pages 82130000 - 82140000 (65536 bytes) + 20 RODATA 1 pages 82140000 - 82150000 (65536 bytes) + 21 CODE 1 pages 82150000 - 82160000 (65536 bytes) + 22 CODE 1 pages 82160000 - 82170000 (65536 bytes) + 23 CODE 1 pages 82170000 - 82180000 (65536 bytes) + 24 CODE 1 pages 82180000 - 82190000 (65536 bytes) + 25 CODE 1 pages 82190000 - 821A0000 (65536 bytes) + 26 CODE 1 pages 821A0000 - 821B0000 (65536 bytes) + 27 CODE 1 pages 821B0000 - 821C0000 (65536 bytes) + 28 CODE 1 pages 821C0000 - 821D0000 (65536 bytes) + 29 CODE 1 pages 821D0000 - 821E0000 (65536 bytes) + 30 CODE 1 pages 821E0000 - 821F0000 (65536 bytes) + 31 CODE 1 pages 821F0000 - 82200000 (65536 bytes) + 32 CODE 1 pages 82200000 - 82210000 (65536 bytes) + 33 CODE 1 pages 82210000 - 82220000 (65536 bytes) + 34 CODE 1 pages 82220000 - 82230000 (65536 bytes) + 35 CODE 1 pages 82230000 - 82240000 (65536 bytes) + 36 CODE 1 pages 82240000 - 82250000 (65536 bytes) + 37 CODE 1 pages 82250000 - 82260000 (65536 bytes) + 38 CODE 1 pages 82260000 - 82270000 (65536 bytes) + 39 CODE 1 pages 82270000 - 82280000 (65536 bytes) + 40 CODE 1 pages 82280000 - 82290000 (65536 bytes) + 41 CODE 1 pages 82290000 - 822A0000 (65536 bytes) + 42 CODE 1 pages 822A0000 - 822B0000 (65536 bytes) + 43 CODE 1 pages 822B0000 - 822C0000 (65536 bytes) + 44 CODE 1 pages 822C0000 - 822D0000 (65536 bytes) + 45 CODE 1 pages 822D0000 - 822E0000 (65536 bytes) + 46 CODE 1 pages 822E0000 - 822F0000 (65536 bytes) + 47 CODE 1 pages 822F0000 - 82300000 (65536 bytes) + 48 CODE 1 pages 82300000 - 82310000 (65536 bytes) + 49 CODE 1 pages 82310000 - 82320000 (65536 bytes) + 50 CODE 1 pages 82320000 - 82330000 (65536 bytes) + 51 CODE 1 pages 82330000 - 82340000 (65536 bytes) + 52 CODE 1 pages 82340000 - 82350000 (65536 bytes) + 53 CODE 1 pages 82350000 - 82360000 (65536 bytes) + 54 CODE 1 pages 82360000 - 82370000 (65536 bytes) + 55 CODE 1 pages 82370000 - 82380000 (65536 bytes) + 56 CODE 1 pages 82380000 - 82390000 (65536 bytes) + 57 CODE 1 pages 82390000 - 823A0000 (65536 bytes) + 58 CODE 1 pages 823A0000 - 823B0000 (65536 bytes) + 59 CODE 1 pages 823B0000 - 823C0000 (65536 bytes) + 60 CODE 1 pages 823C0000 - 823D0000 (65536 bytes) + 61 CODE 1 pages 823D0000 - 823E0000 (65536 bytes) + 62 CODE 1 pages 823E0000 - 823F0000 (65536 bytes) + 63 CODE 1 pages 823F0000 - 82400000 (65536 bytes) + 64 CODE 1 pages 82400000 - 82410000 (65536 bytes) + 65 CODE 1 pages 82410000 - 82420000 (65536 bytes) + 66 CODE 1 pages 82420000 - 82430000 (65536 bytes) + 67 CODE 1 pages 82430000 - 82440000 (65536 bytes) + 68 CODE 1 pages 82440000 - 82450000 (65536 bytes) + 69 CODE 1 pages 82450000 - 82460000 (65536 bytes) + 70 CODE 1 pages 82460000 - 82470000 (65536 bytes) + 71 CODE 1 pages 82470000 - 82480000 (65536 bytes) + 72 CODE 1 pages 82480000 - 82490000 (65536 bytes) + 73 CODE 1 pages 82490000 - 824A0000 (65536 bytes) + 74 CODE 1 pages 824A0000 - 824B0000 (65536 bytes) + 75 CODE 1 pages 824B0000 - 824C0000 (65536 bytes) + 76 CODE 1 pages 824C0000 - 824D0000 (65536 bytes) + 77 CODE 1 pages 824D0000 - 824E0000 (65536 bytes) + 78 CODE 1 pages 824E0000 - 824F0000 (65536 bytes) + 79 CODE 1 pages 824F0000 - 82500000 (65536 bytes) + 80 CODE 1 pages 82500000 - 82510000 (65536 bytes) + 81 CODE 1 pages 82510000 - 82520000 (65536 bytes) + 82 CODE 1 pages 82520000 - 82530000 (65536 bytes) + 83 CODE 1 pages 82530000 - 82540000 (65536 bytes) + 84 CODE 1 pages 82540000 - 82550000 (65536 bytes) + 85 CODE 1 pages 82550000 - 82560000 (65536 bytes) + 86 CODE 1 pages 82560000 - 82570000 (65536 bytes) + 87 CODE 1 pages 82570000 - 82580000 (65536 bytes) + 88 CODE 1 pages 82580000 - 82590000 (65536 bytes) + 89 CODE 1 pages 82590000 - 825A0000 (65536 bytes) + 90 CODE 1 pages 825A0000 - 825B0000 (65536 bytes) + 91 CODE 1 pages 825B0000 - 825C0000 (65536 bytes) + 92 CODE 1 pages 825C0000 - 825D0000 (65536 bytes) + 93 CODE 1 pages 825D0000 - 825E0000 (65536 bytes) + 94 CODE 1 pages 825E0000 - 825F0000 (65536 bytes) + 95 CODE 1 pages 825F0000 - 82600000 (65536 bytes) + 96 CODE 1 pages 82600000 - 82610000 (65536 bytes) + 97 CODE 1 pages 82610000 - 82620000 (65536 bytes) + 98 CODE 1 pages 82620000 - 82630000 (65536 bytes) + 99 CODE 1 pages 82630000 - 82640000 (65536 bytes) + 100 CODE 1 pages 82640000 - 82650000 (65536 bytes) + 101 CODE 1 pages 82650000 - 82660000 (65536 bytes) + 102 CODE 1 pages 82660000 - 82670000 (65536 bytes) + 103 CODE 1 pages 82670000 - 82680000 (65536 bytes) + 104 CODE 1 pages 82680000 - 82690000 (65536 bytes) + 105 CODE 1 pages 82690000 - 826A0000 (65536 bytes) + 106 CODE 1 pages 826A0000 - 826B0000 (65536 bytes) + 107 CODE 1 pages 826B0000 - 826C0000 (65536 bytes) + 108 CODE 1 pages 826C0000 - 826D0000 (65536 bytes) + 109 CODE 1 pages 826D0000 - 826E0000 (65536 bytes) + 110 CODE 1 pages 826E0000 - 826F0000 (65536 bytes) + 111 CODE 1 pages 826F0000 - 82700000 (65536 bytes) + 112 CODE 1 pages 82700000 - 82710000 (65536 bytes) + 113 CODE 1 pages 82710000 - 82720000 (65536 bytes) + 114 CODE 1 pages 82720000 - 82730000 (65536 bytes) + 115 CODE 1 pages 82730000 - 82740000 (65536 bytes) + 116 CODE 1 pages 82740000 - 82750000 (65536 bytes) + 117 CODE 1 pages 82750000 - 82760000 (65536 bytes) + 118 CODE 1 pages 82760000 - 82770000 (65536 bytes) + 119 CODE 1 pages 82770000 - 82780000 (65536 bytes) + 120 CODE 1 pages 82780000 - 82790000 (65536 bytes) + 121 CODE 1 pages 82790000 - 827A0000 (65536 bytes) + 122 CODE 1 pages 827A0000 - 827B0000 (65536 bytes) + 123 CODE 1 pages 827B0000 - 827C0000 (65536 bytes) + 124 CODE 1 pages 827C0000 - 827D0000 (65536 bytes) + 125 CODE 1 pages 827D0000 - 827E0000 (65536 bytes) + 126 CODE 1 pages 827E0000 - 827F0000 (65536 bytes) + 127 CODE 1 pages 827F0000 - 82800000 (65536 bytes) + 128 CODE 1 pages 82800000 - 82810000 (65536 bytes) + 129 CODE 1 pages 82810000 - 82820000 (65536 bytes) + 130 CODE 1 pages 82820000 - 82830000 (65536 bytes) + 131 CODE 1 pages 82830000 - 82840000 (65536 bytes) + 132 CODE 1 pages 82840000 - 82850000 (65536 bytes) + 133 CODE 1 pages 82850000 - 82860000 (65536 bytes) + 134 CODE 1 pages 82860000 - 82870000 (65536 bytes) + 135 RWDATA 1 pages 82870000 - 82880000 (65536 bytes) + 136 RWDATA 1 pages 82880000 - 82890000 (65536 bytes) + 137 RWDATA 1 pages 82890000 - 828A0000 (65536 bytes) + 138 RWDATA 1 pages 828A0000 - 828B0000 (65536 bytes) + 139 RWDATA 1 pages 828B0000 - 828C0000 (65536 bytes) + 140 RWDATA 1 pages 828C0000 - 828D0000 (65536 bytes) + 141 RWDATA 1 pages 828D0000 - 828E0000 (65536 bytes) + 142 RWDATA 1 pages 828E0000 - 828F0000 (65536 bytes) + 143 RWDATA 1 pages 828F0000 - 82900000 (65536 bytes) + 144 RWDATA 1 pages 82900000 - 82910000 (65536 bytes) + 145 RWDATA 1 pages 82910000 - 82920000 (65536 bytes) +Imports: + xam - 52 imports + Version: 0.0.4552.32 + Min Version: 0.0.4552.32 + + Total: 52 + Known: 100% (52 known, 0 unknown) + Implemented: 98% (51 implemented, 1 unimplemented) + + F 82000600 8284DA7C 28C ( 652) XNotifyPositionUI + F 82000604 8284DA8C 2BC ( 700) XamShowSigninUI + F 82000608 8284DA9C 2C1 ( 705) XamShowKeyboardUI + F 8200060C 8284DAAC 2D5 ( 725) !! XamShowGamerCardUIForXUID + F 82000610 8284DABC 2CB ( 715) XamShowDeviceSelectorUI + F 82000614 8284DACC 2D9 ( 729) XamShowDirtyDiscErrorUI + F 82000618 8284DADC 1B3 ( 435) XamTaskShouldExit + F 8200061C 8284DAEC 1B1 ( 433) XamTaskCloseHandle + F 82000620 8284DAFC 1AF ( 431) XamTaskSchedule + F 82000624 8284DB0C 1A4 ( 420) XamLoaderLaunchTitle + F 82000628 8284DB1C 1F7 ( 503) XMsgStartIORequest + F 8200062C 8284DB2C 20E ( 526) XamUserGetName + F 82000630 8284DB3C 210 ( 528) XamUserGetSigninState + F 82000634 8284DB4C 282 ( 642) XamGetSystemVersion + F 82000638 8284DB5C 2F7 ( 759) XamUserCreateStatsEnumerator + F 8200063C 8284DB6C 2EE ( 750) XamUserCreateAchievementEnumerator + F 82000640 8284DB7C 20A ( 522) XamUserGetXUID + F 82000644 8284DB8C 250 ( 592) XamEnumerate + F 82000648 8284DB9C 3CC ( 972) XGetGameRegion + F 8200064C 8284DBAC 190 ( 400) XamInputGetCapabilities + F 82000650 8284DBBC 191 ( 401) XamInputGetState + F 82000654 8284DBCC 192 ( 402) XamInputSetState + F 82000658 8284DBDC 198 ( 408) XamInputGetKeystrokeEx + F 8200065C 8284DBEC 258 ( 600) XamContentCreate + F 82000660 8284DBFC 25B ( 603) XamContentDelete + F 82000664 8284DC0C 25A ( 602) XamContentClose + F 82000668 8284DC1C 260 ( 608) XamContentSetThumbnail + F 8200066C 8284DC2C 262 ( 610) XamContentGetCreator + F 82000670 8284DC3C 25C ( 604) XamContentCreateEnumerator + F 82000674 8284DC4C 265 ( 613) XamContentGetDeviceState + F 82000678 8284DC5C 25E ( 606) XamContentGetDeviceData + F 8200067C 8284DC6C 25F ( 607) XamContentGetDeviceName + F 82000680 8284DC7C 1A0 ( 416) XamEnableInactivityProcessing + F 82000684 8284DC8C 1A1 ( 417) XamResetInactivity + F 82000688 8284DC9C 2DC ( 732) XamShowMessageBoxUIEx + F 8200068C 8284DCAC 3CD ( 973) XGetLanguage + F 82000690 8284DCBC 3CB ( 971) XGetAVPack + F 82000694 8284DCCC 1A9 ( 425) XamLoaderTerminateTitle + F 82000698 8284DCDC 280 ( 640) XamGetExecutionId + F 8200069C 8284E45C 28B ( 651) XNotifyGetNext + F 820006A0 8284E44C 002 ( 2) NetDll_WSACleanup + F 820006A4 8284E43C 001 ( 1) NetDll_WSAStartup + F 820006A8 8284E46C 28A ( 650) XamNotifyCreateListener + F 820006AC 8284E42C 316 ( 790) XamSessionCreateHandle + F 820006B0 8284E41C 317 ( 791) XamSessionRefObjByHandle + F 820006B4 8284E40C 21A ( 538) XamUserWriteProfileSettings + F 820006B8 8284E3FC 219 ( 537) XamUserReadProfileSettings + F 820006BC 8284E3EC 1EA ( 490) XamAlloc + F 820006C0 8284E3DC 1EC ( 492) XamFree + F 820006C4 8284E3CC 3D1 ( 977) XGetVideoMode + F 820006C8 8284E3BC 1F4 ( 500) XMsgInProcessCall + F 820006CC 8284E3AC 1FC ( 508) XMsgStartIORequestEx + + xboxkrnl - 152 imports + Version: 0.0.4552.32 + Min Version: 0.0.4552.32 + + Total: 152 + Known: 100% (152 known, 0 unknown) + Implemented: 95% (145 implemented, 7 unimplemented) + + F 820006D4 8284E1FC 0B4 ( 180) KfReleaseSpinLock + F 820006D8 8284E20C 0B1 ( 177) KfAcquireSpinLock + F 820006DC 8284E21C 1DF ( 479) KiApcNormalRoutineNop + F 820006E0 8284E22C 1B6 ( 438) VdEnableRingBufferRPtrWriteBack + F 820006E4 8284E23C 1C3 ( 451) VdInitializeRingBuffer + F 820006E8 8284E24C 0BE ( 190) MmGetPhysicalAddress + F 820006EC 8284E25C 1D9 ( 473) VdSetSystemCommandBufferGpuIdentifierAddress + F 820006F0 8284E26C 13B ( 315) sprintf + F 820006F4 8284E27C 1B9 ( 441) VdGetCurrentDisplayGamma + V 820006F8 266 ( 614) KeCertMonitorData + F 820006FC 8284E28C 14D ( 333) _vsnprintf + V 82000700 158 ( 344) XboxKrnlVersion + F 82000704 8284E29C 1DC ( 476) VdShutdownEngines + F 82000708 8284E2AC 1CA ( 458) VdQueryVideoMode + F 8200070C 8284E2BC 1BA ( 442) VdGetCurrentDisplayInformation + F 82000710 8284E2CC 1D3 ( 467) VdSetDisplayMode + F 82000714 8284E2DC 1D5 ( 469) VdSetGraphicsInterruptCallback + F 82000718 8284E2EC 1C2 ( 450) VdInitializeEngines + F 8200071C 8284E2FC 1C6 ( 454) VdIsHSIOTrainingSucceeded + F 82000720 8284E30C 1C9 ( 457) VdQueryVideoFlags + F 82000724 8284E31C 1B1 ( 433) VdCallGraphicsNotificationRoutines + V 82000728 1C0 ( 448) VdGpuClockInMHz + F 8200072C 8284E32C 1C5 ( 453) VdInitializeScalerCommandBuffer + F 82000730 8284E33C 269 ( 617) VdRetrainEDRAM + F 82000734 8284E34C 26A ( 618) VdRetrainEDRAMWorker + V 82000738 1C1 ( 449) VdHSIOCalibrationLock + F 8200073C 8284E35C 06B ( 107) KeLockL2 + F 82000740 8284E36C 06C ( 108) KeUnlockL2 + F 82000744 8284E37C 1C7 ( 455) VdPersistDisplay + F 82000748 8284E38C 25B ( 603) VdSwap + F 8200074C 8284E39C 1BD ( 445) VdGetSystemCommandBuffer + V 82000750 1BE ( 446) VdGlobalDevice + F 82000754 8284E1EC 04D ( 77) KeAcquireSpinLockAtRaisedIrql + F 82000758 8284E1DC 089 ( 137) KeReleaseSpinLockFromRaisedIrql + F 8200075C 8284E1CC 1B4 ( 436) VdEnableDisableClockGating + F 82000760 8284E1BC 13F ( 319) RtlTimeFieldsToTime + F 82000764 8284E1AC 136 ( 310) RtlRaiseException + F 82000768 8284E19C 0EE ( 238) NtQueryVirtualMemory + F 8200076C 8284E18C 11B ( 283) RtlCompareMemoryUlong + F 82000770 8284E17C 066 ( 102) KeGetCurrentProcessType + F 82000774 8284E16C 053 ( 83) KeBugCheckEx + F 82000778 8284E15C 126 ( 294) RtlFillMemoryUlong + V 8200077C 1AE ( 430) ExLoadedCommandLine + F 82000780 8284E14C 05A ( 90) KeDelayExecutionThread + F 82000784 8284E13C 143 ( 323) RtlUnicodeToMultiByteN + F 82000788 8284E12C 0E4 ( 228) NtQueryDirectoryFile + F 8200078C 8284E10C 019 ( 25) ExTerminateThread + F 82000790 8284E0FC 09B ( 155) KeSetCurrentStackPointers + F 82000794 8284E0EC 197 ( 407) XexGetProcedureAddress + F 82000798 8284E0DC 03C ( 60) !! IoDismountVolumeByFileHandle + F 8200079C 8284E0CC 0D9 ( 217) NtDeviceIoControlFile + F 820007A0 8284E0BC 028 ( 40) HalReturnToFirmware + F 820007A4 8284E0AC 003 ( 3) DbgPrint + F 820007A8 8284E09C 140 ( 320) RtlTimeToTimeFields + F 820007AC 8284E08C 0FE ( 254) NtWaitForMultipleObjectsEx + F 820007B0 8284E07C 0F3 ( 243) NtReleaseSemaphore + F 820007B4 8284E06C 0D5 ( 213) NtCreateSemaphore + F 820007B8 8284E05C 084 ( 132) KeQuerySystemTime + F 820007BC 8284E04C 0E8 ( 232) NtQueryInformationFile + F 820007C0 8284E03C 0F7 ( 247) NtSetInformationFile + F 820007C4 8284E02C 0FD ( 253) NtWaitForSingleObjectEx + F 820007C8 8284E01C 0CE ( 206) NtClearEvent + F 820007CC 8284E00C 0F5 ( 245) NtResumeThread + V 820007D0 0AD ( 173) KeTimeStampBundle + F 820007D4 8284DFFC 010 ( 16) ExGetXConfigSetting + V 820007D8 059 ( 89) KeDebugMonitorData + F 820007DC 8284DFEC 097 ( 151) KeSetAffinityThread + F 820007E0 8284DFDC 0FC ( 252) NtSuspendThread + F 820007E4 8284DFCC 081 ( 129) KeQueryBasePriorityThread + V 820007E8 01B ( 27) ExThreadObjectType + F 820007EC 8284DFBC 110 ( 272) ObReferenceObjectByHandle + F 820007F0 8284DFAC 099 ( 153) KeSetBasePriorityThread + F 820007F4 8284DF9C 10B ( 267) ObLookupThreadByThreadId + F 820007F8 8284DF8C 10E ( 270) ObOpenObjectByPointer + F 820007FC 8284DF7C 0DA ( 218) NtDuplicateObject + F 82000800 8284DF6C 101 ( 257) NtYieldExecution + F 82000804 8284DF5C 0F6 ( 246) NtSetEvent + F 82000808 8284DF4C 052 ( 82) KeBugCheck + F 8200080C 8284DF3C 0BC ( 188) MmDeleteKernelStack + F 82000810 8284DF2C 0BB ( 187) MmCreateKernelStack + F 82000814 8284DF1C 0D1 ( 209) NtCreateEvent + F 82000818 8284DF0C 135 ( 309) RtlNtStatusToDosError + F 8200081C 8284DEFC 194 ( 404) XexCheckExecutablePrivilege + F 82000820 8284DEEC 05F ( 95) KeEnterCriticalRegion + F 82000824 8284DEDC 07D ( 125) KeLeaveCriticalRegion + F 82000828 8284DECC 0CC ( 204) NtAllocateVirtualMemory + F 8200082C 8284DEBC 259 ( 601) !! StfsCreateDevice + F 82000830 8284DEAC 103 ( 259) ObCreateSymbolicLink + F 82000834 8284DE9C 25A ( 602) !! StfsControlDevice + F 82000838 8284DE8C 0DB ( 219) NtFlushBuffersFile + F 8200083C 8284DE7C 104 ( 260) ObDeleteSymbolicLink + F 82000840 8284DE6C 105 ( 261) ObDereferenceObject + F 82000844 8284DE5C 0DC ( 220) NtFreeVirtualMemory + F 82000848 8284DE4C 0D2 ( 210) NtCreateFile + F 8200084C 8284DE3C 256 ( 598) XeKeysConsolePrivateKeySign + F 82000850 8284DE2C 0F0 ( 240) NtReadFile + F 82000854 8284DE1C 0FF ( 255) NtWriteFile + F 82000858 8284DE0C 192 ( 402) XeCryptSha + F 8200085C 8284DDFC 257 ( 599) !! XeKeysConsoleSignatureVerification + F 82000860 8284DDEC 015 ( 21) ExRegisterTitleTerminateNotification + F 82000864 8284DDDC 09D ( 157) KeSetEvent + F 82000868 8284DDCC 0B0 ( 176) KeWaitForSingleObject + F 8200086C 8284DDBC 08F ( 143) KeResetEvent + V 82000870 193 ( 403) XexExecutableModuleHandle + F 82000874 8284DDAC 12B ( 299) RtlImageXexHeaderField + F 82000878 8284DD9C 1A5 ( 421) !! __C_specific_handler + F 8200087C 8284DD8C 12C ( 300) RtlInitAnsiString + F 82000880 8284DD7C 0DF ( 223) NtOpenFile + F 82000884 8284DD6C 0CF ( 207) NtClose + F 82000888 8284DD5C 0EF ( 239) NtQueryVolumeInformationFile + F 8200088C 8284DD4C 0C4 ( 196) MmQueryAddressProtect + F 82000890 8284DD3C 0BD ( 189) MmFreePhysicalMemory + F 82000894 8284DD2C 0BA ( 186) MmAllocatePhysicalMemoryEx + F 82000898 8284DD1C 12E ( 302) RtlInitializeCriticalSection + F 8200089C 8284DD0C 130 ( 304) RtlLeaveCriticalSection + F 820008A0 8284DCFC 125 ( 293) RtlEnterCriticalSection + F 820008A4 8284DCEC 12F ( 303) RtlInitializeCriticalSectionAndSpinCount + F 820008A8 8284E11C 00D ( 13) ExCreateThread + F 820008AC 8284E47C 085 ( 133) KeRaiseIrqlToDpcLevel + F 820008B0 8284E48C 0B3 ( 179) KfLowerIrql + F 820008B4 8284E49C 088 ( 136) KeReleaseSemaphore + F 820008B8 8284E4AC 1F8 ( 504) XAudioGetVoiceCategoryVolume + F 820008BC 8284E4BC 1F7 ( 503) XAudioGetVoiceCategoryVolumeChangeMask + F 820008C0 8284E4CC 0AF ( 175) KeWaitForMultipleObjects + F 820008C4 8284E4DC 092 ( 146) KeResumeThread + F 820008C8 8284E4EC 074 ( 116) KeInitializeSemaphore + F 820008CC 8284E4FC 226 ( 550) XMAReleaseContext + F 820008D0 8284E50C 224 ( 548) XMACreateContext + F 820008D4 8284E51C 083 ( 131) KeQueryPerformanceFrequency + F 820008D8 8284E52C 141 ( 321) RtlTryEnterCriticalSection + F 820008DC 8284E53C 0AE ( 174) KeTryToAcquireSpinLockAtRaisedIrql + F 820008E0 8284E54C 1F3 ( 499) XAudioRegisterRenderDriverClient + F 820008E4 8284E55C 1F4 ( 500) XAudioUnregisterRenderDriverClient + F 820008E8 8284E56C 1F5 ( 501) XAudioSubmitRenderDriverFrame + F 820008EC 8284E57C 195 ( 405) XexGetModuleHandle + F 820008F0 8284E58C 147 ( 327) !! RtlUnwind + F 820008F4 8284E59C 152 ( 338) KeTlsAlloc + F 820008F8 8284E5AC 154 ( 340) KeTlsGetValue + F 820008FC 8284E5BC 155 ( 341) KeTlsSetValue + F 82000900 8284E5CC 153 ( 339) KeTlsFree + F 82000904 8284E5DC 119 ( 281) !! RtlCaptureContext + F 82000908 8284E5EC 05D ( 93) KeEnableFpuExceptions + F 8200090C 8284E5FC 0C6 ( 198) MmQueryStatistics + F 82000910 8284E60C 0D7 ( 215) NtCreateTimer + F 82000914 8284E61C 0FA ( 250) NtSetTimerEx + F 82000918 8284E62C 0CD ( 205) NtCancelTimer + F 8200091C 8284E63C 0E7 ( 231) NtQueryFullAttributesFile + F 82000920 8284E64C 127 ( 295) RtlFreeAnsiString + F 82000924 8284E65C 142 ( 322) RtlUnicodeStringToAnsiString + F 82000928 8284E66C 12D ( 301) RtlInitUnicodeString + F 8200092C 8284E67C 133 ( 307) RtlMultiByteToUnicodeN + F 82000930 8284E68C 001 ( 1) DbgBreakPoint + +w> 000000D8 GameDatabase: Title doesn't contain XLAST data! Multiplayer functionality might be limited. +i> 000000D8 Title name: PROJECT SYLPHEED +i> 000000D8 +-------------------- ACHIEVEMENTS -------------------- ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| ID | Title | Description | Type | Gamerscore | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 1 | Space Combat Award | Received after your first space battle in the Glasner Training Area. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 2 | Schlos Base Defense Award | Received for stopping the missile attack on Schlos Base. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 3 | Aegis of the People Medal | Received for escorting all 7 refugee ships to safety. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 4 | TCAF Luna Medal | Received for bravely helping the fleet escape during the invasion of the Matisse System. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 5 | TCAF Mars Medal | Received for bravery beyond the call of duty during the escape from the Matisse System. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 6 | Soldier's Charm Amulet | Given to you by Raymond as a token of his trust. | Event | 50 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 7 | White Griffons Patch | Received by the commander and pilots of the White Griffon Squadron when it is formed. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 8 | TCAF Jupiter Medal | Received for bravery during the enemy's attack on the Alberti System. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 9 | Furious Pursuit Badge | Received for continuing attacks on the enemy and shooting down a large number of ships. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 10 | Solo Aerospace Combat Award | Received for descending into Acheron's atmosphere and engaging in combat alone. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 11 | Operation Nebula Blaze Award | Received for completing the extremely hazardous Operation Nebula Blaze. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 12 | Guilty Roses Patch | Received for repelling the Guilty Roses Squadron. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 13 | Super Battleship Slayer Patch | Received for shooting down the second S battleship. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 14 | TCAF Terra Medal | Received for shielding the fleet and seeing that all ships safely fled the Ingres System. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 15 | Hellfires Patch | Received for repelling the enemy Hellfire Squadron. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 16 | Night Ravens Patch | Received for challenging and eradicating the Night Raven Squadron. | Event | 50 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 17 | Solar System Defense Award | Received for great achievements during the campaign to defend the Solar System. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 18 | Special Operations Medal | Received for heroically destroying the Prometheus Driver. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 19 | 1,000 Units Destroyed Medal | Received for shooting down 1,000 enemy fighters and attackers in combat. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 20 | 10,000 Units Destroyed Medal | Received for shooting down 10,000 enemy fighters and attackers in combat. | Event | 70 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 21 | Ship Hunter Award | Received for shooting down 100 enemy warships in combat. | Event | 50 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 22 | Gigaton Club Patch | Received for shooting down enemy vessels with a total weight of one gigaton. | Event | 70 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 23 | Weapon Lord Patch | Received after you collect all usable equipment for the Delta Saber. | Event | 80 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 24 | TCAF Pilot's Commendation | Commemmorates you as one of the greatest pilots in history. | Event | 100 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +i> 000000D8 +-------------------- PROPERTIES -------------------- ++----------+------------------+-------------+-----------+ +| ID | Name | Matchmaking | Data Size | ++----------+------------------+-------------+-----------+ +| 10000006 | Killed Aircrafts | False | 4 | ++----------+------------------+-------------+-----------+ +| 10000008 | Equipments | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000000A | Clear Time | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000000B | Killed Warships | False | 4 | ++----------+------------------+-------------+-----------+ +| 10008001 | Rank | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000800A | | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000800B | | False | 4 | ++----------+------------------+-------------+-----------+ +| 20000005 | Killed Weight | False | 8 | ++----------+------------------+-------------+-----------+ +| 20000007 | Clear Time | False | 8 | ++----------+------------------+-------------+-----------+ +| 20000009 | Earned Points | False | 8 | ++----------+------------------+-------------+-----------+ +| 40008002 | Gamer Name | False | 2 | ++----------+------------------+-------------+-----------+ +i> 000000D8 +-------------------- CONTEXTS -------------------- ++----------+-------------+-------------+---------------+-----------+ +| ID | Name | Matchmaking | Default Value | Max Value | ++----------+-------------+-------------+---------------+-----------+ +| 00000000 | Game Stage | False | 0 | 28 | ++----------+-------------+-------------+---------------+-----------+ +| 00000001 | Game Status | False | 0 | 9 | ++----------+-------------+-------------+---------------+-----------+ +| 00008001 | | False | 0 | 0 | ++----------+-------------+-------------+---------------+-----------+ +| 0000800A | Game Type | True | 0 | 1 | ++----------+-------------+-------------+---------------+-----------+ +| 0000800B | | True | 0 | 0 | ++----------+-------------+-------------+---------------+-----------+ +i> 000000D8 +-------------------- STATS VIEWS -------------------- ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| ID | View Type | Name | Skilled | Arbitrated | Hidden | Team View | Online Only | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000001 | Leaderboard | Time Attack (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000002 | Leaderboard | Score Attack (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000003 | Leaderboard | Extra 1 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000004 | Leaderboard | Extra 1 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000005 | Leaderboard | Extra 2 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000006 | Leaderboard | Extra 2 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000007 | Leaderboard | Extra 3 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000008 | Leaderboard | Extra 3 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000009 | Leaderboard | Extra 4 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 0000000A | Leaderboard | Extra 4 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 0000000C | Leaderboard | Time Attack (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 0000000D | Leaderboard | Score Attack (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| FFFF0000 | Leaderboard | | True | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +i> 000000D8 +-------------------- PRESENCE MODES -------------------- ++---------------+----------------+------------------+ +| Context Value | Contexts Count | Properties Count | ++---------------+----------------+------------------+ +| 0 | 2 | 0 | ++---------------+----------------+------------------+ +i> 000000D8 XThread01000020 (5) Stack: 70110000-70130000 +i> 000000D8 KernelState: Launching module... +i> 000000D8 XThreadF8000008 (6) Stack: 70150000-701D0000 +K> 01000020 XThread::Execute thid 5 (handle=01000020, 'Kernel Dispatch (01000020)', native=00000194, ) +i> 01000010 Loaded 7 shaders from storage +i> 01000010 Loaded 4 pipeline descriptions, 8 shader translations needed +K> F8000008 XThread::Execute thid 6 (handle=F8000008, 'Main XThread (F8000008)', native=00000198) +i> 01000010 Translated 7 shaders in 3 ms +i> 01000010 Pipeline cache loaded: 4 created, 0 already exist, 4 total stored +i> 01000010 Pipeline creation took 0 milliseconds +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800000C type=1 initial_state=0 lr=824A9F6C +F> F8000008 NullDevice::ResolvePath() +F> F8000008 NullDevice::ResolvePath() +F> F8000008 NullDevice::ResolvePath() +!> F8000008 undefined extern call to 8284E0DC IoDismountVolumeByFileHandle +F> F8000008 NullDevice::ResolvePath() +i> F8000008 Got xam task args: v1 = 02080002, v2 = 00000000 +i> F8000008 XThreadF8000010 (7) Stack: 701F0000-70270000 +K> F8000010 XThread::Execute thid 7 (handle=F8000010, 'XThread01BC (F8000010)', native=000001BC) +F> F8000010 NullDevice::ResolvePath() +w> F8000010 Game is attempting to allocate devkit debug memory (base: 00000000, size: 000FF000). Ignoring debug flag and using normal allocation. +!> F8000010 undefined extern call to 8284DEBC StfsCreateDevice +K> F8000010 AUDIT-HLC KeSetEvent guest_ptr=8287094C lr=824A95D0 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000020 type=1 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000024 (8) Stack: 70290000-702B0000 +K> F8000024 XThread::Execute thid 8 (handle=F8000024, 'XThread01C0 (F8000024)', native=000001C0) +K> F8000024 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000020 alertable=0 lr=824AC578 guest_lr=824AFFC4 +F> F8000008 HostPathDevice::ResolvePath() +i> F8000008 XThreadF800002C (9) Stack: 702D0000-702E0000 +K> F800002C XThread::Execute thid 9 (handle=F800002C, 'XThread01C4 (F800002C)', native=000001C4) +F> F800002C HostPathDevice::ResolvePath() +F> F800002C HostPathDevice::ResolvePath() +F> F8000008 HostPathDevice::ResolvePath(\d4ea4615\e\46ee8ca) +F> F8000008 HostPathDevice::ResolvePath(\d4ea4615\e) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800003C type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000040 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000048 (A) Stack: 70300000-70340000 +K> F8000048 XThread::Execute thid 10 (handle=F8000048, 'XThread01C8 (F8000048)', native=000001C8) +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800003C alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000050 type=0 initial_state=0 lr=824A9F6C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +!> F800002C BaseHeap::Release failed because address is not a region start +!> F800002C PhysicalHeap::Release failed due to parent heap failure +F> F800002C HostPathDevice::ResolvePath() +K> F8000048 AUDIT-HLC NtSetEvent handle=F800004C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800003C result=00000000 lr=824AC578 guest_lr=82452E64 +F> F800002C HostPathDevice::ResolvePath() +!> F800002C BaseHeap::Release failed because address is not a region start +!> F800002C PhysicalHeap::Release failed due to parent heap failure +K> F800002C AUDIT-HLC NtWaitForSingleObjectEx handle=F8000028 alertable=0 lr=824AC578 guest_lr=824AFFC4 +!> F8000008 BaseHeap::Release failed because address is not a region start +!> F8000008 PhysicalHeap::Release failed due to parent heap failure +!> F8000008 BaseHeap::Release failed because address is not a region start +!> F8000008 PhysicalHeap::Release failed due to parent heap failure +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\8\3421153) +F> F8000008 DiscImageDevice::ResolvePath(\dat) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\355f2f8) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000038 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800004C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800004C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000050 type=0 initial_state=0 lr=824A9F6C +i> F8000048 XThreadF8000058 (B) Stack: 70360000-70370000 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F800004C alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 XThread::Execute thid 11 (handle=F8000058, 'XThread01CC (F8000058)', native=000001CC) +K> F8000058 AUDIT-HLC NtSetEvent handle=F800004C lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800004C result=00000000 lr=824AC578 guest_lr=8245148C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F800003C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=82452E64 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000038 type=1 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +i> F8000008 XThreadF800004C (C) Stack: 70390000-703A0000 +K> F800004C XThread::Execute thid 12 (handle=F800004C, 'XThread01D0 (F800004C)', native=000001D0) +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +i> F8000008 Hardware scaler: width ratio 1:1, height ratio 1:1, final aspect ratio 16:9 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +i> 01000010 Selecting rep movs vastcpy. +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000060 type=1 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000064 type=1 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000068 (D) Stack: 703C0000-70440000 +K> F8000068 XThread::Execute thid 13 (handle=F8000068, 'XThread01D4 (F8000068)', native=000001D4) +F> F8000008 HostPathDevice::ResolvePath(\aab216c3\a\2c8c185) +F> F8000008 HostPathDevice::ResolvePath(\aab216c3\a) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000070 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000070 alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000078 alertable=0 lr=824AC578 guest_lr=8245148C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000058 AUDIT-HLC NtSetEvent handle=F8000078 lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000078 result=00000000 lr=824AC578 guest_lr=8245148C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000074 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000070 result=00000000 lr=824AC578 guest_lr=82452E64 +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\73a5c0a) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000070 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000070 alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000078 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 AUDIT-HLC NtSetEvent handle=F8000078 lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000078 result=00000000 lr=824AC578 guest_lr=8245148C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000074 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000070 result=00000000 lr=824AC578 guest_lr=82452E64 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +i> F8000008 XThreadF8000070 (E) Stack: 70460000-704E0000 +i> F8000008 XThreadF8000074 (F) Stack: 70500000-70580000 +K> F8000070 XThread::Execute thid 14 (handle=F8000070, 'XThread01D8 (F8000070)', native=000001D8) +K> F8000074 XThread::Execute thid 15 (handle=F8000074, 'XThread01DC (F8000074)', native=000001DC) +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +i> F8000008 AudioSystem::RegisterClient: driver created for index=0, driver=0x787e2d000040 +i> F8000008 AudioSystem::RegisterClient: client 0 registered successfully +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000088 type=0 initial_state=0 lr=824A9F6C +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\39a9dcc) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000088 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000090 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000088 result=00000000 lr=824AC578 guest_lr=8245FA10 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000088 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +F> F8000008 DiscImageDevice::ResolvePath(\dat) +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000090 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000088 alertable=0 lr=824AC578 guest_lr=82460150 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000088 result=00000000 lr=824AC578 guest_lr=82460150 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000088 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000088 alertable=0 lr=824AC578 guest_lr=82179148 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000090 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000088 result=00000000 lr=824AC578 guest_lr=82179148 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +i> F8000008 XThreadF8000088 (10) Stack: 705A0000-705B0000 +K> F8000088 XThread::Execute thid 16 (handle=F8000088, 'XThread01F0 (F8000088)', native=000001F0) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000094 alertable=0 lr=824AC578 guest_lr=82173BD4 +K> F8000068 AUDIT-HLC NtSetEvent handle=F8000094 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000094 result=00000000 lr=824AC578 guest_lr=82173BD4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000098 (11) Stack: 705D0000-70650000 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000098 alertable=0 lr=824AC578 guest_lr=822F1B50 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000098 XThread::Execute thid 17 (handle=F8000098, 'XThread01F4 (F8000098)', native=000001F4) +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000098 AUDIT-HLC NtCreateEvent handle=F800009C type=1 initial_state=1 lr=824A9F6C +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000A0 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\aab216c3\5\ee70e0a) +F> F8000098 HostPathDevice::ResolvePath(\aab216c3\5) +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A0 alertable=0 lr=824AC578 guest_lr=821CBAE0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000AC alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 AUDIT-HLC NtSetEvent handle=F80000AC lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000AC result=00000000 lr=824AC578 guest_lr=8245148C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000A8 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000A0 result=00000000 lr=824AC578 guest_lr=821CBAE0 +i> F8000098 XThreadF80000A0 (12) Stack: 70670000-70680000 +K> F80000A0 XThread::Execute thid 18 (handle=F80000A0, 'XThread01F8 (F80000A0)', native=000001F8) +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +i> F80000A0 XThreadF80000A8 (13) Stack: 706A0000-706D0000 +i> F80000A0 XThreadF80000AC (14) Stack: 706F0000-70720000 +K> F80000A8 XThread::Execute thid 19 (handle=F80000A8, 'XThread01FC (F80000A8)', native=000001FC) +K> F80000AC XThread::Execute thid 20 (handle=F80000AC, 'XThread0200 (F80000AC)', native=00000200) +K> F80000A8 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A4 alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F80000AC AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A4 alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\c\dba806e) +F> F8000098 HostPathDevice::ResolvePath(\87719002\c) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +F> F8000098 HostPathDevice::ResolvePath(\87719002\c\ec0a96e) +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +F> F8000098 HostPathDevice::ResolvePath(\87719002\c) +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000C8 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\a\60fcb85) +F> F8000098 HostPathDevice::ResolvePath(\87719002\a) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000D4 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\2\85d8849) +F> F8000098 HostPathDevice::ResolvePath(\87719002\2) +F> F80000A0 DiscImageDevice::ResolvePath(\hidden\Resource3D) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000E4 type=1 initial_state=0 lr=824A9F6C +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000E8 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\a\715f485) +F> F8000098 HostPathDevice::ResolvePath(\87719002\a) +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=822DFCC8 +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000F8 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\c\f2a8ccd) +F> F8000098 HostPathDevice::ResolvePath(\87719002\c) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\0\1a2db9c) +F> F8000098 HostPathDevice::ResolvePath(\87719002\0) +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E8 alertable=0 lr=824AC578 guest_lr=821C515C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000B8 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000C4 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D0 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000E0 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000EC lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=822DFCC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=822DFE24 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000F4 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E8 result=00000000 lr=824AC578 guest_lr=821C515C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000100 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000098 result=00000000 lr=824AC578 guest_lr=822F1B50 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F800010C lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000B8 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=822DFE24 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=822DFED0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000098 (15) Stack: 705D0000-705E0000 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C0 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C0 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000098 XThread::Execute thid 21 (handle=F8000098, 'XThread0204 (F8000098)', native=00000204) +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C0 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000C4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000094 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=822DFED0 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000094 type=1 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +i> F8000008 XThreadF80000C4 (16) Stack: 70600000-70610000 +K> F80000C4 XThread::Execute thid 22 (handle=F80000C4, 'XThread0208 (F80000C4)', native=00000208) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000CC type=0 initial_state=0 lr=824A9F6C +F> F80000A0 DiscImageDevice::ResolvePath(\hidden\Resource3D) +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000CC alertable=0 lr=824AC578 guest_lr=82172BC8 +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000D8 type=1 initial_state=0 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D8 alertable=0 lr=824AC578 guest_lr=822DFCC8 +K> F80000C4 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000094 alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000CC lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000CC result=00000000 lr=824AC578 guest_lr=82172BC8 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000CC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000DC lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D8 result=00000000 lr=824AC578 guest_lr=822DFCC8 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D8 alertable=0 lr=824AC578 guest_lr=822DFE24 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000CC lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D8 result=00000000 lr=824AC578 guest_lr=822DFE24 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D8 alertable=0 lr=824AC578 guest_lr=822DFED0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000E4 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000E4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF80000F0 (17) Stack: 70630000-70640000 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +K> F80000F0 XThread::Execute thid 23 (handle=F80000F0, 'XThread020C (F80000F0)', native=0000020C) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000F4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000100 (18) Stack: 70740000-707C0000 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF800010C (19) Stack: 707E0000-70860000 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000100 XThread::Execute thid 24 (handle=F8000100, 'XThread0210 (F8000100)', native=00000210) +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F800010C XThread::Execute thid 25 (handle=F800010C, 'XThread0214 (F800010C)', native=00000214) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000CC lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D8 result=00000000 lr=824AC578 guest_lr=822DFED0 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +F> F80000A0 DiscImageDevice::ResolvePath(\hidden\Resource3D) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000D0 type=1 initial_state=0 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFCC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFCC8 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFE24 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFE24 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFED0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B0 alertable=0 lr=824AC578 guest_lr=821CC19C +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000B0 lr=824AA304 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFED0 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B0 result=00000000 lr=824AC578 guest_lr=821CC19C +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\f\ca5c62e) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\d\14ba3f8) +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\d) +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B0 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D0 type=0 initial_state=0 lr=824A9F6C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B0 result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\8\14c242d) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\5\6324af0) +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\5) +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B0 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B0 result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\d\70a9531) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\a\c9606f9) +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\a) +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B0 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B0 result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\7\9f2d535) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\4\efaecd1) +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\4) +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B0 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B0 result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\7\0c3bba2) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\4\59fbfe8) +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\4) +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B0 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B0 result=00000000 lr=824AC578 guest_lr=8245FA10 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800009C alertable=0 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800009C result=00000000 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800009C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000BC alertable=0 lr=824AC578 guest_lr=821CC19C +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000BC lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000BC result=00000000 lr=824AC578 guest_lr=821CC19C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800009C alertable=0 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800009C result=00000000 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800009C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF80000CC (1A) Stack: 70880000-70900000 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F80000CC XThread::Execute thid 26 (handle=F80000CC, 'XThread0218 (F80000CC)', native=00000218) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F80000CC AUDIT-HLC NtCreateEvent handle=F80000D8 type=1 initial_state=1 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F80000CC AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +F> F80000CC HostPathDevice::ResolvePath(\aab216c3\5\c10eae6) +F> F80000CC HostPathDevice::ResolvePath(\aab216c3\5) +K> F80000CC AUDIT-HLC NtWaitForSingleObjectEx handle=F80000FC alertable=0 lr=824AC578 guest_lr=821CBAE0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000118 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000118 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000118 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 AUDIT-HLC NtSetEvent handle=F8000118 lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000118 result=00000000 lr=824AC578 guest_lr=8245148C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000114 lr=824AA304 +K> F80000CC AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000FC result=00000000 lr=824AC578 guest_lr=821CBAE0 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000088 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +F> F8000088 DiscImageDevice::ResolvePath(\dat) +K> F8000088 AUDIT-HLC NtSetEvent handle=F8000118 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000110 alertable=0 lr=824AC578 guest_lr=82460150 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000110 result=00000000 lr=824AC578 guest_lr=82460150 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000DC alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000DC result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000BC alertable=0 lr=824AC578 guest_lr=82172BC8 +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000BC lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000BC result=00000000 lr=824AC578 guest_lr=82172BC8 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC JitProlog pc=821B55D8 tid=00000006 r3=BCCC52C0 r4=FFFFFFFF r5=00004D2E r6=00000000 r7=64000000 r8=0000003F r9=BC366BA0 r10=00000008 lr=82172D8C +K> F8000008 AUDIT-HLC JitProlog pc=821B55D8 r3+00: 820A3644 00000001 00000000 F80000D8 +K> F8000008 AUDIT-HLC JitProlog pc=821B55D8 r3+10: 0101FFFF 00000000 FFFFFFFF 00000000 +K> F8000008 AUDIT-HLC JitProlog pc=821B55D8 r3+20: FFFFFFFF 00000000 00000000 00000002 +K> F8000008 AUDIT-HLC JitProlog pc=821B55D8 r3+30: 820A1870 00000000 BC22CAE0 00000000 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +F> F8000008 DiscImageDevice::ResolvePath(\dat\movie) +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000118 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800011C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000120 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000124 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000128 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800012C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000130 type=0 initial_state=1 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +F> F8000008 DiscImageDevice::ResolvePath(\dat\movie) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000138 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800013C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000140 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000144 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000148 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800014C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000150 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000154 type=0 initial_state=1 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +i> F8000008 XThreadF8000158 (1B) Stack: 70880000-70890000 +i> F8000008 XThreadF800015C (1C) Stack: 708B0000-708C0000 +i> F8000008 XThreadF8000160 (1D) Stack: 708E0000-708F0000 +i> F8000008 XThreadF8000164 (1E) Stack: 70910000-70920000 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25404 lr=82507ABC +K> F800015C XThread::Execute thid 28 (handle=F800015C, 'XThread0220 (F800015C)', native=00000220) +K> F8000158 XThread::Execute thid 27 (handle=F8000158, 'XThread021C (F8000158)', native=0000021C) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000160 XThread::Execute thid 29 (handle=F8000160, 'XThread0224 (F8000160)', native=00000224) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C diff --git a/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.stdout.sub821B6DF4_zero b/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.stdout.sub821B6DF4_zero new file mode 100644 index 0000000..366638f --- /dev/null +++ b/audit-runs/audit-059-handle-disambiguation/round9-sub821B6DF4-caller/canary.stdout.sub821B6DF4_zero @@ -0,0 +1,36427 @@ +i> 000000D4 Build: canary_experimental@99fd19d02 on Jun 5 2026 +i> 000000D4 Storage root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug +i> 000000D4 ----------- CONFIG DUMP ----------- + +[APU] +apu = "any" +apu_max_queued_frames = 8 +enable_xmp = true +ffmpeg_verbose = false +mute = false +use_dedicated_xma_thread = true +xma_decoder = "new" + +[Auditing] +audit_handle_lifecycle = true +audit_jit_prolog_pc = 2182835700 + +[CPU] +break_condition_gpr = -1 +break_condition_op = "eq" +break_condition_truncate = true +break_condition_value = 0 +break_on_debugbreak = true +break_on_instruction = 0 +break_on_start = false +break_on_unimplemented_instructions = true +clock_no_scaling = false +clock_source_raw = false +cpu = "any" +debug_symbol_loader = false +debugprint_trap_log = false +disable_context_promotion = false +disable_instruction_infocache = false +disable_prefetch_and_cachecontrol = true +disassemble_functions = false +dump_translated_hir_functions = false +elide_e0_check = false +emit_inline_mmio_checks = false +emit_mmio_aware_stores_for_recorded_exception_addresses = true +emit_source_annotations = false +enable_early_precompilation = false +full_optimization_even_with_debug = false +ignore_trap_instructions = true +ignore_undefined_externs = true +inline_loadclock = false +inline_mmio_access = true +load_module_map = "" +no_reserved_ops = false +no_round_to_single = false +permit_float_constant_evaluation = false +pvr = 7407360 +record_mmio_access_exceptions = true +store_all_context_values = false +trace_function_coverage = false +trace_function_data = false +trace_function_data_path = "" +trace_function_references = false +trace_functions = false +use_fast_dot_product = false +validate_hir = false +writable_code_segments = false + +[Config] +defaults_date = 2026040912 + +[Content] +license_mask = 0 + +[D3D12] +d3d12_adapter = -1 +d3d12_allow_variable_refresh_rate_and_tearing = true +d3d12_bindless = true +d3d12_break_on_error = false +d3d12_break_on_warning = false +d3d12_debug = false +d3d12_dxbc_disasm = false +d3d12_dxbc_disasm_dxilconv = false +d3d12_pipeline_creation_threads = -1 +d3d12_queue_priority = 1 +d3d12_submit_on_primary_buffer_end = true +d3d12_tessellation_wireframe = false + +[Display] +fullscreen = false +host_present_from_non_ui_thread = true +postprocess_antialiasing = "" +postprocess_dither = true +postprocess_ffx_cas_additional_sharpness = 0 +postprocess_ffx_fsr_max_upsampling_passes = 4 +postprocess_ffx_fsr_sharpness_reduction = 0.20000000298023224 +postprocess_scaling_and_sharpening = "" +present_letterbox = true +present_render_pass_clear = true +present_safe_area_x = 100 +present_safe_area_y = 100 + +[GPU] +anisotropic_override = -1 +async_shader_compilation = true +clear_memory_page_state = false +depth_float24_convert_in_pixel_shader = false +depth_float24_round = false +depth_transfer_not_equal_test = true +disassemble_pm4 = false +draw_resolution_scale_x = 1 +draw_resolution_scale_y = 1 +draw_resolution_scaled_texture_offsets = true +dump_shaders = "" +dxbc_source_map = false +dxbc_switch = true +execute_unclipped_draw_vs_on_cpu = true +execute_unclipped_draw_vs_on_cpu_for_psi_render_backend = true +execute_unclipped_draw_vs_on_cpu_with_scissor = false +force_convert_line_loops_to_strips = false +force_convert_quad_lists_to_triangle_lists = false +force_convert_triangle_fans_to_lists = false +framerate_limit = 0 +gamma_render_target_as_unorm16 = true +gpu = "any" +gpu_3d_to_2d_texture = true +gpu_allow_invalid_fetch_constants = true +gpu_allow_invalid_upload_range = false +half_pixel_offset = true +ignore_32bit_vertex_index_support = false +log_guest_driven_gpu_register_written_values = false +log_ringbuffer_kickoff_initiator_bts = false +mrt_edram_used_range_clamp_to_min = true +native_2x_msaa = true +native_stencil_value_output = true +native_stencil_value_output_d3d12_intel = false +no_discard_stencil_in_transfer_pipelines = false +non_seamless_cube_map = true +occlusion_query = "fast" +occlusion_query_fake_lower_threshold = 80 +occlusion_query_fake_upper_threshold = 100 +occlusion_query_querybatch_range = 0 +occlusion_query_saturation = 1 +primitive_processor_cache_min_indices = 4096 +readback_memexport = false +readback_resolve = "none" +render_target_path_d3d12 = "" +render_target_path_vulkan = "" +resolve_resolution_scale_fill_half_pixel_offset = true +snorm16_render_target_full_range = true +store_shaders = true +target_trace_file = "" +texture_cache_memory_limit_hard = 768 +texture_cache_memory_limit_render_to_texture = 24 +texture_cache_memory_limit_soft = 384 +texture_cache_memory_limit_soft_lifetime = 30 +tiled_shared_memory = true +trace_dump_path = "" +trace_gpu_prefix = "scratch/gpu/" +trace_gpu_stream = false +use_fuzzy_alpha_epsilon = false +vsync = true + +[General] +allow_game_relative_writes = false +allow_plugins = false +apply_patches = true +controller_hotkeys = false +debug = false +disable_doubleclick_fullscreen = false +discord = true +launch_module = "" +notification_sound_path = "" +priority_class = 0 +recent_titles_entry_amount = 10 +time_scalar = 1 + +[HACKS] +ac6_ground_fix = false + +[HID] +guide_button = true +hid = "any" +keyboard_mode = 0 +keyboard_user_index = 0 +left_stick_deadzone_percentage = 0 +right_stick_deadzone_percentage = 0 +vibration = true + +[HID.WinKey] +keybind_a = "0xBA" +keybind_b = "0xDE" +keybind_back = "Z" +keybind_dpad_down = "^S" +keybind_dpad_left = "^A" +keybind_dpad_right = "^D" +keybind_dpad_up = "^W" +keybind_guide = "0x08" +keybind_left_shoulder = "1" +keybind_left_thumb = "F" +keybind_left_thumb_down = "_S" +keybind_left_thumb_left = "_A" +keybind_left_thumb_right = "_D" +keybind_left_thumb_up = "_W" +keybind_left_trigger = "Q I" +keybind_right_shoulder = "3" +keybind_right_thumb = "K" +keybind_right_thumb_down = "0x28" +keybind_right_thumb_left = "0x25" +keybind_right_thumb_right = "0x27" +keybind_right_thumb_up = "0x26" +keybind_right_trigger = "E O" +keybind_start = "X" +keybind_x = "L" +keybind_y = "P" + +[Kernel] +allow_avatar_initialization = false +allow_incompatible_title_update = true +apply_title_update = true +cl = "" +console_type = 0 +default_achievements_backend = "GPD" +ignore_thread_affinities = true +ignore_thread_priorities = false +kernel_build_version = 1888 +kernel_cert_monitor = false +kernel_debug_monitor = false +kernel_display_gamma_power = 2.22222233 +kernel_display_gamma_type = 2 +kernel_pix = false +staging_mode = false + +[Logging] +enable_console = false +flush_log = true +log_file = "" +log_high_frequency_kernel_calls = false +log_level = 2 +log_mask = 0 +log_string_format_kernel_calls = false +log_to_debugprint = false +log_to_stdout = true + +[Memory] +ignore_offset_for_ranged_allocations = false +protect_on_release = false +protect_zero = true +scribble_heap = false +scribble_heap_value = 0 +writable_executable_memory = true + +[Profiles] +logged_profile_slot_0_xuid = "" +logged_profile_slot_1_xuid = "" +logged_profile_slot_2_xuid = "" +logged_profile_slot_3_xuid = "" + +[SDL] +mappings_file = "gamecontrollerdb.txt" + +[Storage] +cache_root = "" +content_root = "" +force_mount_devkit = false +mount_cache = true +mount_memory_unit = false +mount_scratch = false +storage_root = "" + +[UI] +custom_font_path = "" +font_size = 14 +headless = false +imgui_debug = false +profiler_dpi_scaling = false +show_achievement_notification = false +show_profiler = false +storage_selection_dialog = false +window_size_x = 1280 +window_size_y = 720 + +[Video] +avpack = 8 +custom_internal_display_resolution_x = 0 +custom_internal_display_resolution_y = 0 +enable_3d_mode = false +interlaced = false + +[Vulkan] +vulkan_allow_present_mode_fifo_relaxed = true +vulkan_allow_present_mode_immediate = true +vulkan_allow_present_mode_mailbox = true +vulkan_device = -1 +vulkan_log_debug_messages = true +vulkan_pipeline_creation_threads = -1 +vulkan_semaphore_reuse_workaround = false +vulkan_sparse_shared_memory = true +vulkan_validation = false + +[Win32] +win32_high_resolution_timer = true +win32_mmcss = true + +[x64] +align_all_basic_blocks = 0 +delay_via_maybeyield = false +enable_host_guest_stack_synchronization = true +enable_incorrect_roundingmode_behavior = false +enable_rmw_context_merging = false +instrument_call_times = false +max_stackpoints = 65536 +x64_extension_mask = -1 +xop_arithmetic_right_shifts = false +xop_compares = true +xop_left_shifts = false +xop_right_shifts = false +xop_rotates = false +----------- END OF CONFIG DUMP ---- +i> 000000D4 Loaded config: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\xenia-canary.config.toml +i> 000000D4 Content root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\content +i> 000000D4 Host cache root: Z:\home\fabi\RE Project Sylpheed\xenia-canary\build-cross\bin\Windows\Debug\cache_host +w> 000000D4 Unable to load Japanese font; JP characters will be boxes +w> 000000D4 Unable to load Japanese font; JP characters will be boxes +i> 00000124 Setup: Initializing Memory... +i> 00000124 Setup: Initializing Exports... +i> 00000124 Setup: Initializing Processor... +i> 00000124 Setup: Initializing Audio... +i> 00000124 Setup: Initializing Graphics... +i> 00000124 Setup: Initializing HID... +i> 00000124 winkey: "0x08" binds key 0x8 to controller input GUIDE. +i> 00000124 winkey: "^A" binds key 0x41 to controller input DPAD_LEFT. +i> 00000124 winkey: "^D" binds key 0x44 to controller input DPAD_RIGHT. +i> 00000124 winkey: "^S" binds key 0x53 to controller input DPAD_DOWN. +i> 00000124 winkey: "^W" binds key 0x57 to controller input DPAD_UP. +i> 00000124 winkey: "_A" binds key 0x41 to controller input LEFT_THUMB_LEFT. +i> 00000124 winkey: "_D" binds key 0x44 to controller input LEFT_THUMB_RIGHT. +i> 00000124 winkey: "_S" binds key 0x53 to controller input LEFT_THUMB_DOWN. +i> 00000124 winkey: "_W" binds key 0x57 to controller input LEFT_THUMB_UP. +i> 00000124 winkey: "F" binds key 0x46 to controller input LEFT_THUMB_PRESSED. +i> 00000124 winkey: "0x26" binds key 0x26 to controller input RIGHT_THUMB_UP. +i> 00000124 winkey: "0x28" binds key 0x28 to controller input RIGHT_THUMB_DOWN. +i> 00000124 winkey: "0x27" binds key 0x27 to controller input RIGHT_THUMB_RIGHT. +i> 00000124 winkey: "0x25" binds key 0x25 to controller input RIGHT_THUMB_LEFT. +i> 00000124 winkey: "K" binds key 0x4B to controller input RIGHT_THUMB_PRESSED. +i> 00000124 winkey: "L" binds key 0x4C to controller input X. +i> 00000124 winkey: "0xDE" binds key 0xDE to controller input B. +i> 00000124 winkey: "0xBA" binds key 0xBA to controller input A. +i> 00000124 winkey: "P" binds key 0x50 to controller input Y. +i> 00000124 winkey: "Q" binds key 0x51 to controller input LEFT_TRIGGER. +i> 00000124 winkey: "I" binds key 0x49 to controller input LEFT_TRIGGER. +i> 00000124 winkey: "E" binds key 0x45 to controller input RIGHT_TRIGGER. +i> 00000124 winkey: "O" binds key 0x4F to controller input RIGHT_TRIGGER. +i> 00000124 winkey: "Z" binds key 0x5A to controller input BACK. +i> 00000124 winkey: "X" binds key 0x58 to controller input START. +i> 00000124 winkey: "1" binds key 0x31 to controller input LEFT_SHOULDER. +i> 00000124 winkey: "3" binds key 0x33 to controller input RIGHT_SHOULDER. +i> 000000D4 SDL Version 2.32.2 initialized. +w> 000000D4 SDL GameControllerDB: file 'gamecontrollerdb.txt' does not exist. +i> 00000124 Setup: Initializing VFS... +i> 00000124 PatchDB: Loaded patches for 0 titles +i> 00000124 Setup: Initializing Kernel... +i> 00000124 ProfileManager: Found 0 Profiles +w> 00000124 BaseHeap::AllocFixed attempting commit on unreserved page +w> 00000124 BaseHeap::AllocFixed attempting commit on unreserved page +i> 00000124 Setup: Starting graphics_system... +i> 00000124 DXGI adapter: NVIDIA GeForce GTX 1070 Ti (vendor 0x1002, device 0x73DF) +i> 00000124 Direct3D 12 device and OS features: +* Max GPU virtual address bits per resource: 40 +* Non-zeroed heap creation: yes +* Pixel-shader-specified stencil reference: no +* Programmable sample positions: tier 0 +* Rasterizer-ordered views: yes +* Resource binding: tier 3 +* Tiled resources: tier 4 +* Unaligned block-compressed textures: yes +i> 00000124 XThread01000010 (1) Stack: 70010000-70030000 +i> 00000124 XThread01000014 (2) Stack: 70050000-70070000 +i> 00000124 Setup: Starting audio_system... +K> 01000010 XThread::Execute thid 1 (handle=01000010, 'GPU Commands (01000010)', native=00000154, ) +K> 01000014 XThread::Execute thid 2 (handle=01000014, 'GPU Frame limiter (01000014)', native=00000158, ) +i> 00000124 XThread01000018 (3) Stack: 70090000-700B0000 +i> 00000124 XThread0100001C (4) Stack: 700D0000-700F0000 +K> 01000018 XThread::Execute thid 3 (handle=01000018, 'XMA Decoder (01000018)', native=00000180, ) +K> 0100001C XThread::Execute thid 4 (handle=0100001C, 'Audio Worker (0100001C)', native=00000184, ) +i> 000000D4 Checking for XISO +F> 000000D4 DiscImageDevice::Initialize +i> 000000D4 Checking for XISO +F> 000000D4 DiscImageDevice::Initialize +F> 000000D4 DiscImageDevice::Initialize +i> 000000D4 Loading module GAME:\default.xex +F> 000000D4 DiscImageDevice::ResolvePath(\default.xex) +i> 000000D4 Module \Device\Cdrom0\default.xex: +Module Hash: CCF935D24A74E002 + Module Flags: 00000001 + XEX_MODULE_TITLE +Security Header: + Image Flags: 00000008 + XEX_IMAGE_XGD2_MEDIA_ONLY + Load Address: 82000000 + Image Size: 00920000 + Export Table: 00000000 +Optional Header Count: 15 + XEX_HEADER_RESOURCE_INFO: + 535107D4 828FB900-8291D8CF, 139215b + XEX_HEADER_FILE_FORMAT_INFO: + Info Size: 36 + Encryption Type: Normal + Compression Type: Normal + Window Size: 32768 + Block Size: 61440 + Block Hash: B3 2B D7 D4 EF 96 9A C5 9F D7 77 C6 8A 99 AA 1C BD 87 1C BE 00 90 2E F1 46 3F A3 D7 00 00 00 10 + XEX_HEADER_ENTRY_POINT: 824AB748 + XEX_HEADER_IMAGE_BASE_ADDRESS: 82000000 + XEX_HEADER_IMPORT_LIBRARIES: + xam.xex - 104 imports + Version: 2.0.4552.0 + Min Version: 2.0.4552.0 + xboxkrnl.exe - 294 imports + Version: 2.0.4552.0 + Min Version: 2.0.4552.0 + XEX_HEADER_CHECKSUM_TIMESTAMP: + Checksum : 00902EF1 + Time Stamp: 463FA3D7 - Tue May 8 00:10:31 2007 + XEX_HEADER_ORIGINAL_PE_NAME: default.pe + XEX_HEADER_STATIC_LIBRARIES: + XAPILIB : 2.0.3215.0 + D3D9 : 2.0.3215.1 + D3DX9 : 2.0.3215.0 + XBOXKRNL : 2.0.3215.0 + XAUD : 2.0.3215.0 + LIBCPMT : 2.0.3215.0 + XMP : 2.0.3215.0 + XMEDIA : 2.0.3215.0 + XONLINE : 2.0.3215.0 + XGRAPHC : 2.0.3215.0 + X3DAUD : 2.0.3215.1 + XACT : 2.0.3215.1 + XEX_HEADER_TLS_INFO: + Slot Count: 64 + Raw Data Address: 00000000 + Data Size: 0 + Raw Data Size: 0 + XEX_HEADER_DEFAULT_STACK_SIZE: 524288 + XEX_HEADER_SYSTEM_FLAGS: 00000400 + XEX_SYSTEM_PAL50_INCOMPATIBLE + XEX_HEADER_EXECUTION_INFO: + Media ID: 2D2E2EEB + Title ID: 535107D4 + Savegame ID: 535107D4 + Disc Number / Total: 1 / 1 + XEX_HEADER_GAME_RATINGS: + ESRB: Teen + PEGI: 12+ + PEGI-FI: 11+ + PEGI - PT: 12+ + BBFC: 12+ + CERO: Unrated + USK: Approved for children aged 12 and above + OFLC - AU: Parental Guidance + OFLC - NZ: Parental Guidance + KMRB: Unrated + Brazil: Unrated + FPB: 13+ + XEX_HEADER_LAN_KEY: E0 3C EA 47 3C AE 06 62 98 8F DB 7F 58 50 12 38 + XEX_HEADER_XBOX360_LOGO: + Section Size: 1736 + Logo Size: 1728 +Sections: + 0 RODATA 1 pages 82000000 - 82010000 (65536 bytes) + 1 RODATA 1 pages 82010000 - 82020000 (65536 bytes) + 2 RODATA 1 pages 82020000 - 82030000 (65536 bytes) + 3 RODATA 1 pages 82030000 - 82040000 (65536 bytes) + 4 RODATA 1 pages 82040000 - 82050000 (65536 bytes) + 5 RODATA 1 pages 82050000 - 82060000 (65536 bytes) + 6 RODATA 1 pages 82060000 - 82070000 (65536 bytes) + 7 RODATA 1 pages 82070000 - 82080000 (65536 bytes) + 8 RODATA 1 pages 82080000 - 82090000 (65536 bytes) + 9 RODATA 1 pages 82090000 - 820A0000 (65536 bytes) + 10 RODATA 1 pages 820A0000 - 820B0000 (65536 bytes) + 11 RODATA 1 pages 820B0000 - 820C0000 (65536 bytes) + 12 RODATA 1 pages 820C0000 - 820D0000 (65536 bytes) + 13 RODATA 1 pages 820D0000 - 820E0000 (65536 bytes) + 14 RODATA 1 pages 820E0000 - 820F0000 (65536 bytes) + 15 RODATA 1 pages 820F0000 - 82100000 (65536 bytes) + 16 RODATA 1 pages 82100000 - 82110000 (65536 bytes) + 17 RODATA 1 pages 82110000 - 82120000 (65536 bytes) + 18 RODATA 1 pages 82120000 - 82130000 (65536 bytes) + 19 RODATA 1 pages 82130000 - 82140000 (65536 bytes) + 20 RODATA 1 pages 82140000 - 82150000 (65536 bytes) + 21 CODE 1 pages 82150000 - 82160000 (65536 bytes) + 22 CODE 1 pages 82160000 - 82170000 (65536 bytes) + 23 CODE 1 pages 82170000 - 82180000 (65536 bytes) + 24 CODE 1 pages 82180000 - 82190000 (65536 bytes) + 25 CODE 1 pages 82190000 - 821A0000 (65536 bytes) + 26 CODE 1 pages 821A0000 - 821B0000 (65536 bytes) + 27 CODE 1 pages 821B0000 - 821C0000 (65536 bytes) + 28 CODE 1 pages 821C0000 - 821D0000 (65536 bytes) + 29 CODE 1 pages 821D0000 - 821E0000 (65536 bytes) + 30 CODE 1 pages 821E0000 - 821F0000 (65536 bytes) + 31 CODE 1 pages 821F0000 - 82200000 (65536 bytes) + 32 CODE 1 pages 82200000 - 82210000 (65536 bytes) + 33 CODE 1 pages 82210000 - 82220000 (65536 bytes) + 34 CODE 1 pages 82220000 - 82230000 (65536 bytes) + 35 CODE 1 pages 82230000 - 82240000 (65536 bytes) + 36 CODE 1 pages 82240000 - 82250000 (65536 bytes) + 37 CODE 1 pages 82250000 - 82260000 (65536 bytes) + 38 CODE 1 pages 82260000 - 82270000 (65536 bytes) + 39 CODE 1 pages 82270000 - 82280000 (65536 bytes) + 40 CODE 1 pages 82280000 - 82290000 (65536 bytes) + 41 CODE 1 pages 82290000 - 822A0000 (65536 bytes) + 42 CODE 1 pages 822A0000 - 822B0000 (65536 bytes) + 43 CODE 1 pages 822B0000 - 822C0000 (65536 bytes) + 44 CODE 1 pages 822C0000 - 822D0000 (65536 bytes) + 45 CODE 1 pages 822D0000 - 822E0000 (65536 bytes) + 46 CODE 1 pages 822E0000 - 822F0000 (65536 bytes) + 47 CODE 1 pages 822F0000 - 82300000 (65536 bytes) + 48 CODE 1 pages 82300000 - 82310000 (65536 bytes) + 49 CODE 1 pages 82310000 - 82320000 (65536 bytes) + 50 CODE 1 pages 82320000 - 82330000 (65536 bytes) + 51 CODE 1 pages 82330000 - 82340000 (65536 bytes) + 52 CODE 1 pages 82340000 - 82350000 (65536 bytes) + 53 CODE 1 pages 82350000 - 82360000 (65536 bytes) + 54 CODE 1 pages 82360000 - 82370000 (65536 bytes) + 55 CODE 1 pages 82370000 - 82380000 (65536 bytes) + 56 CODE 1 pages 82380000 - 82390000 (65536 bytes) + 57 CODE 1 pages 82390000 - 823A0000 (65536 bytes) + 58 CODE 1 pages 823A0000 - 823B0000 (65536 bytes) + 59 CODE 1 pages 823B0000 - 823C0000 (65536 bytes) + 60 CODE 1 pages 823C0000 - 823D0000 (65536 bytes) + 61 CODE 1 pages 823D0000 - 823E0000 (65536 bytes) + 62 CODE 1 pages 823E0000 - 823F0000 (65536 bytes) + 63 CODE 1 pages 823F0000 - 82400000 (65536 bytes) + 64 CODE 1 pages 82400000 - 82410000 (65536 bytes) + 65 CODE 1 pages 82410000 - 82420000 (65536 bytes) + 66 CODE 1 pages 82420000 - 82430000 (65536 bytes) + 67 CODE 1 pages 82430000 - 82440000 (65536 bytes) + 68 CODE 1 pages 82440000 - 82450000 (65536 bytes) + 69 CODE 1 pages 82450000 - 82460000 (65536 bytes) + 70 CODE 1 pages 82460000 - 82470000 (65536 bytes) + 71 CODE 1 pages 82470000 - 82480000 (65536 bytes) + 72 CODE 1 pages 82480000 - 82490000 (65536 bytes) + 73 CODE 1 pages 82490000 - 824A0000 (65536 bytes) + 74 CODE 1 pages 824A0000 - 824B0000 (65536 bytes) + 75 CODE 1 pages 824B0000 - 824C0000 (65536 bytes) + 76 CODE 1 pages 824C0000 - 824D0000 (65536 bytes) + 77 CODE 1 pages 824D0000 - 824E0000 (65536 bytes) + 78 CODE 1 pages 824E0000 - 824F0000 (65536 bytes) + 79 CODE 1 pages 824F0000 - 82500000 (65536 bytes) + 80 CODE 1 pages 82500000 - 82510000 (65536 bytes) + 81 CODE 1 pages 82510000 - 82520000 (65536 bytes) + 82 CODE 1 pages 82520000 - 82530000 (65536 bytes) + 83 CODE 1 pages 82530000 - 82540000 (65536 bytes) + 84 CODE 1 pages 82540000 - 82550000 (65536 bytes) + 85 CODE 1 pages 82550000 - 82560000 (65536 bytes) + 86 CODE 1 pages 82560000 - 82570000 (65536 bytes) + 87 CODE 1 pages 82570000 - 82580000 (65536 bytes) + 88 CODE 1 pages 82580000 - 82590000 (65536 bytes) + 89 CODE 1 pages 82590000 - 825A0000 (65536 bytes) + 90 CODE 1 pages 825A0000 - 825B0000 (65536 bytes) + 91 CODE 1 pages 825B0000 - 825C0000 (65536 bytes) + 92 CODE 1 pages 825C0000 - 825D0000 (65536 bytes) + 93 CODE 1 pages 825D0000 - 825E0000 (65536 bytes) + 94 CODE 1 pages 825E0000 - 825F0000 (65536 bytes) + 95 CODE 1 pages 825F0000 - 82600000 (65536 bytes) + 96 CODE 1 pages 82600000 - 82610000 (65536 bytes) + 97 CODE 1 pages 82610000 - 82620000 (65536 bytes) + 98 CODE 1 pages 82620000 - 82630000 (65536 bytes) + 99 CODE 1 pages 82630000 - 82640000 (65536 bytes) + 100 CODE 1 pages 82640000 - 82650000 (65536 bytes) + 101 CODE 1 pages 82650000 - 82660000 (65536 bytes) + 102 CODE 1 pages 82660000 - 82670000 (65536 bytes) + 103 CODE 1 pages 82670000 - 82680000 (65536 bytes) + 104 CODE 1 pages 82680000 - 82690000 (65536 bytes) + 105 CODE 1 pages 82690000 - 826A0000 (65536 bytes) + 106 CODE 1 pages 826A0000 - 826B0000 (65536 bytes) + 107 CODE 1 pages 826B0000 - 826C0000 (65536 bytes) + 108 CODE 1 pages 826C0000 - 826D0000 (65536 bytes) + 109 CODE 1 pages 826D0000 - 826E0000 (65536 bytes) + 110 CODE 1 pages 826E0000 - 826F0000 (65536 bytes) + 111 CODE 1 pages 826F0000 - 82700000 (65536 bytes) + 112 CODE 1 pages 82700000 - 82710000 (65536 bytes) + 113 CODE 1 pages 82710000 - 82720000 (65536 bytes) + 114 CODE 1 pages 82720000 - 82730000 (65536 bytes) + 115 CODE 1 pages 82730000 - 82740000 (65536 bytes) + 116 CODE 1 pages 82740000 - 82750000 (65536 bytes) + 117 CODE 1 pages 82750000 - 82760000 (65536 bytes) + 118 CODE 1 pages 82760000 - 82770000 (65536 bytes) + 119 CODE 1 pages 82770000 - 82780000 (65536 bytes) + 120 CODE 1 pages 82780000 - 82790000 (65536 bytes) + 121 CODE 1 pages 82790000 - 827A0000 (65536 bytes) + 122 CODE 1 pages 827A0000 - 827B0000 (65536 bytes) + 123 CODE 1 pages 827B0000 - 827C0000 (65536 bytes) + 124 CODE 1 pages 827C0000 - 827D0000 (65536 bytes) + 125 CODE 1 pages 827D0000 - 827E0000 (65536 bytes) + 126 CODE 1 pages 827E0000 - 827F0000 (65536 bytes) + 127 CODE 1 pages 827F0000 - 82800000 (65536 bytes) + 128 CODE 1 pages 82800000 - 82810000 (65536 bytes) + 129 CODE 1 pages 82810000 - 82820000 (65536 bytes) + 130 CODE 1 pages 82820000 - 82830000 (65536 bytes) + 131 CODE 1 pages 82830000 - 82840000 (65536 bytes) + 132 CODE 1 pages 82840000 - 82850000 (65536 bytes) + 133 CODE 1 pages 82850000 - 82860000 (65536 bytes) + 134 CODE 1 pages 82860000 - 82870000 (65536 bytes) + 135 RWDATA 1 pages 82870000 - 82880000 (65536 bytes) + 136 RWDATA 1 pages 82880000 - 82890000 (65536 bytes) + 137 RWDATA 1 pages 82890000 - 828A0000 (65536 bytes) + 138 RWDATA 1 pages 828A0000 - 828B0000 (65536 bytes) + 139 RWDATA 1 pages 828B0000 - 828C0000 (65536 bytes) + 140 RWDATA 1 pages 828C0000 - 828D0000 (65536 bytes) + 141 RWDATA 1 pages 828D0000 - 828E0000 (65536 bytes) + 142 RWDATA 1 pages 828E0000 - 828F0000 (65536 bytes) + 143 RWDATA 1 pages 828F0000 - 82900000 (65536 bytes) + 144 RWDATA 1 pages 82900000 - 82910000 (65536 bytes) + 145 RWDATA 1 pages 82910000 - 82920000 (65536 bytes) +Imports: + xam - 52 imports + Version: 0.0.4552.32 + Min Version: 0.0.4552.32 + + Total: 52 + Known: 100% (52 known, 0 unknown) + Implemented: 98% (51 implemented, 1 unimplemented) + + F 82000600 8284DA7C 28C ( 652) XNotifyPositionUI + F 82000604 8284DA8C 2BC ( 700) XamShowSigninUI + F 82000608 8284DA9C 2C1 ( 705) XamShowKeyboardUI + F 8200060C 8284DAAC 2D5 ( 725) !! XamShowGamerCardUIForXUID + F 82000610 8284DABC 2CB ( 715) XamShowDeviceSelectorUI + F 82000614 8284DACC 2D9 ( 729) XamShowDirtyDiscErrorUI + F 82000618 8284DADC 1B3 ( 435) XamTaskShouldExit + F 8200061C 8284DAEC 1B1 ( 433) XamTaskCloseHandle + F 82000620 8284DAFC 1AF ( 431) XamTaskSchedule + F 82000624 8284DB0C 1A4 ( 420) XamLoaderLaunchTitle + F 82000628 8284DB1C 1F7 ( 503) XMsgStartIORequest + F 8200062C 8284DB2C 20E ( 526) XamUserGetName + F 82000630 8284DB3C 210 ( 528) XamUserGetSigninState + F 82000634 8284DB4C 282 ( 642) XamGetSystemVersion + F 82000638 8284DB5C 2F7 ( 759) XamUserCreateStatsEnumerator + F 8200063C 8284DB6C 2EE ( 750) XamUserCreateAchievementEnumerator + F 82000640 8284DB7C 20A ( 522) XamUserGetXUID + F 82000644 8284DB8C 250 ( 592) XamEnumerate + F 82000648 8284DB9C 3CC ( 972) XGetGameRegion + F 8200064C 8284DBAC 190 ( 400) XamInputGetCapabilities + F 82000650 8284DBBC 191 ( 401) XamInputGetState + F 82000654 8284DBCC 192 ( 402) XamInputSetState + F 82000658 8284DBDC 198 ( 408) XamInputGetKeystrokeEx + F 8200065C 8284DBEC 258 ( 600) XamContentCreate + F 82000660 8284DBFC 25B ( 603) XamContentDelete + F 82000664 8284DC0C 25A ( 602) XamContentClose + F 82000668 8284DC1C 260 ( 608) XamContentSetThumbnail + F 8200066C 8284DC2C 262 ( 610) XamContentGetCreator + F 82000670 8284DC3C 25C ( 604) XamContentCreateEnumerator + F 82000674 8284DC4C 265 ( 613) XamContentGetDeviceState + F 82000678 8284DC5C 25E ( 606) XamContentGetDeviceData + F 8200067C 8284DC6C 25F ( 607) XamContentGetDeviceName + F 82000680 8284DC7C 1A0 ( 416) XamEnableInactivityProcessing + F 82000684 8284DC8C 1A1 ( 417) XamResetInactivity + F 82000688 8284DC9C 2DC ( 732) XamShowMessageBoxUIEx + F 8200068C 8284DCAC 3CD ( 973) XGetLanguage + F 82000690 8284DCBC 3CB ( 971) XGetAVPack + F 82000694 8284DCCC 1A9 ( 425) XamLoaderTerminateTitle + F 82000698 8284DCDC 280 ( 640) XamGetExecutionId + F 8200069C 8284E45C 28B ( 651) XNotifyGetNext + F 820006A0 8284E44C 002 ( 2) NetDll_WSACleanup + F 820006A4 8284E43C 001 ( 1) NetDll_WSAStartup + F 820006A8 8284E46C 28A ( 650) XamNotifyCreateListener + F 820006AC 8284E42C 316 ( 790) XamSessionCreateHandle + F 820006B0 8284E41C 317 ( 791) XamSessionRefObjByHandle + F 820006B4 8284E40C 21A ( 538) XamUserWriteProfileSettings + F 820006B8 8284E3FC 219 ( 537) XamUserReadProfileSettings + F 820006BC 8284E3EC 1EA ( 490) XamAlloc + F 820006C0 8284E3DC 1EC ( 492) XamFree + F 820006C4 8284E3CC 3D1 ( 977) XGetVideoMode + F 820006C8 8284E3BC 1F4 ( 500) XMsgInProcessCall + F 820006CC 8284E3AC 1FC ( 508) XMsgStartIORequestEx + + xboxkrnl - 152 imports + Version: 0.0.4552.32 + Min Version: 0.0.4552.32 + + Total: 152 + Known: 100% (152 known, 0 unknown) + Implemented: 95% (145 implemented, 7 unimplemented) + + F 820006D4 8284E1FC 0B4 ( 180) KfReleaseSpinLock + F 820006D8 8284E20C 0B1 ( 177) KfAcquireSpinLock + F 820006DC 8284E21C 1DF ( 479) KiApcNormalRoutineNop + F 820006E0 8284E22C 1B6 ( 438) VdEnableRingBufferRPtrWriteBack + F 820006E4 8284E23C 1C3 ( 451) VdInitializeRingBuffer + F 820006E8 8284E24C 0BE ( 190) MmGetPhysicalAddress + F 820006EC 8284E25C 1D9 ( 473) VdSetSystemCommandBufferGpuIdentifierAddress + F 820006F0 8284E26C 13B ( 315) sprintf + F 820006F4 8284E27C 1B9 ( 441) VdGetCurrentDisplayGamma + V 820006F8 266 ( 614) KeCertMonitorData + F 820006FC 8284E28C 14D ( 333) _vsnprintf + V 82000700 158 ( 344) XboxKrnlVersion + F 82000704 8284E29C 1DC ( 476) VdShutdownEngines + F 82000708 8284E2AC 1CA ( 458) VdQueryVideoMode + F 8200070C 8284E2BC 1BA ( 442) VdGetCurrentDisplayInformation + F 82000710 8284E2CC 1D3 ( 467) VdSetDisplayMode + F 82000714 8284E2DC 1D5 ( 469) VdSetGraphicsInterruptCallback + F 82000718 8284E2EC 1C2 ( 450) VdInitializeEngines + F 8200071C 8284E2FC 1C6 ( 454) VdIsHSIOTrainingSucceeded + F 82000720 8284E30C 1C9 ( 457) VdQueryVideoFlags + F 82000724 8284E31C 1B1 ( 433) VdCallGraphicsNotificationRoutines + V 82000728 1C0 ( 448) VdGpuClockInMHz + F 8200072C 8284E32C 1C5 ( 453) VdInitializeScalerCommandBuffer + F 82000730 8284E33C 269 ( 617) VdRetrainEDRAM + F 82000734 8284E34C 26A ( 618) VdRetrainEDRAMWorker + V 82000738 1C1 ( 449) VdHSIOCalibrationLock + F 8200073C 8284E35C 06B ( 107) KeLockL2 + F 82000740 8284E36C 06C ( 108) KeUnlockL2 + F 82000744 8284E37C 1C7 ( 455) VdPersistDisplay + F 82000748 8284E38C 25B ( 603) VdSwap + F 8200074C 8284E39C 1BD ( 445) VdGetSystemCommandBuffer + V 82000750 1BE ( 446) VdGlobalDevice + F 82000754 8284E1EC 04D ( 77) KeAcquireSpinLockAtRaisedIrql + F 82000758 8284E1DC 089 ( 137) KeReleaseSpinLockFromRaisedIrql + F 8200075C 8284E1CC 1B4 ( 436) VdEnableDisableClockGating + F 82000760 8284E1BC 13F ( 319) RtlTimeFieldsToTime + F 82000764 8284E1AC 136 ( 310) RtlRaiseException + F 82000768 8284E19C 0EE ( 238) NtQueryVirtualMemory + F 8200076C 8284E18C 11B ( 283) RtlCompareMemoryUlong + F 82000770 8284E17C 066 ( 102) KeGetCurrentProcessType + F 82000774 8284E16C 053 ( 83) KeBugCheckEx + F 82000778 8284E15C 126 ( 294) RtlFillMemoryUlong + V 8200077C 1AE ( 430) ExLoadedCommandLine + F 82000780 8284E14C 05A ( 90) KeDelayExecutionThread + F 82000784 8284E13C 143 ( 323) RtlUnicodeToMultiByteN + F 82000788 8284E12C 0E4 ( 228) NtQueryDirectoryFile + F 8200078C 8284E10C 019 ( 25) ExTerminateThread + F 82000790 8284E0FC 09B ( 155) KeSetCurrentStackPointers + F 82000794 8284E0EC 197 ( 407) XexGetProcedureAddress + F 82000798 8284E0DC 03C ( 60) !! IoDismountVolumeByFileHandle + F 8200079C 8284E0CC 0D9 ( 217) NtDeviceIoControlFile + F 820007A0 8284E0BC 028 ( 40) HalReturnToFirmware + F 820007A4 8284E0AC 003 ( 3) DbgPrint + F 820007A8 8284E09C 140 ( 320) RtlTimeToTimeFields + F 820007AC 8284E08C 0FE ( 254) NtWaitForMultipleObjectsEx + F 820007B0 8284E07C 0F3 ( 243) NtReleaseSemaphore + F 820007B4 8284E06C 0D5 ( 213) NtCreateSemaphore + F 820007B8 8284E05C 084 ( 132) KeQuerySystemTime + F 820007BC 8284E04C 0E8 ( 232) NtQueryInformationFile + F 820007C0 8284E03C 0F7 ( 247) NtSetInformationFile + F 820007C4 8284E02C 0FD ( 253) NtWaitForSingleObjectEx + F 820007C8 8284E01C 0CE ( 206) NtClearEvent + F 820007CC 8284E00C 0F5 ( 245) NtResumeThread + V 820007D0 0AD ( 173) KeTimeStampBundle + F 820007D4 8284DFFC 010 ( 16) ExGetXConfigSetting + V 820007D8 059 ( 89) KeDebugMonitorData + F 820007DC 8284DFEC 097 ( 151) KeSetAffinityThread + F 820007E0 8284DFDC 0FC ( 252) NtSuspendThread + F 820007E4 8284DFCC 081 ( 129) KeQueryBasePriorityThread + V 820007E8 01B ( 27) ExThreadObjectType + F 820007EC 8284DFBC 110 ( 272) ObReferenceObjectByHandle + F 820007F0 8284DFAC 099 ( 153) KeSetBasePriorityThread + F 820007F4 8284DF9C 10B ( 267) ObLookupThreadByThreadId + F 820007F8 8284DF8C 10E ( 270) ObOpenObjectByPointer + F 820007FC 8284DF7C 0DA ( 218) NtDuplicateObject + F 82000800 8284DF6C 101 ( 257) NtYieldExecution + F 82000804 8284DF5C 0F6 ( 246) NtSetEvent + F 82000808 8284DF4C 052 ( 82) KeBugCheck + F 8200080C 8284DF3C 0BC ( 188) MmDeleteKernelStack + F 82000810 8284DF2C 0BB ( 187) MmCreateKernelStack + F 82000814 8284DF1C 0D1 ( 209) NtCreateEvent + F 82000818 8284DF0C 135 ( 309) RtlNtStatusToDosError + F 8200081C 8284DEFC 194 ( 404) XexCheckExecutablePrivilege + F 82000820 8284DEEC 05F ( 95) KeEnterCriticalRegion + F 82000824 8284DEDC 07D ( 125) KeLeaveCriticalRegion + F 82000828 8284DECC 0CC ( 204) NtAllocateVirtualMemory + F 8200082C 8284DEBC 259 ( 601) !! StfsCreateDevice + F 82000830 8284DEAC 103 ( 259) ObCreateSymbolicLink + F 82000834 8284DE9C 25A ( 602) !! StfsControlDevice + F 82000838 8284DE8C 0DB ( 219) NtFlushBuffersFile + F 8200083C 8284DE7C 104 ( 260) ObDeleteSymbolicLink + F 82000840 8284DE6C 105 ( 261) ObDereferenceObject + F 82000844 8284DE5C 0DC ( 220) NtFreeVirtualMemory + F 82000848 8284DE4C 0D2 ( 210) NtCreateFile + F 8200084C 8284DE3C 256 ( 598) XeKeysConsolePrivateKeySign + F 82000850 8284DE2C 0F0 ( 240) NtReadFile + F 82000854 8284DE1C 0FF ( 255) NtWriteFile + F 82000858 8284DE0C 192 ( 402) XeCryptSha + F 8200085C 8284DDFC 257 ( 599) !! XeKeysConsoleSignatureVerification + F 82000860 8284DDEC 015 ( 21) ExRegisterTitleTerminateNotification + F 82000864 8284DDDC 09D ( 157) KeSetEvent + F 82000868 8284DDCC 0B0 ( 176) KeWaitForSingleObject + F 8200086C 8284DDBC 08F ( 143) KeResetEvent + V 82000870 193 ( 403) XexExecutableModuleHandle + F 82000874 8284DDAC 12B ( 299) RtlImageXexHeaderField + F 82000878 8284DD9C 1A5 ( 421) !! __C_specific_handler + F 8200087C 8284DD8C 12C ( 300) RtlInitAnsiString + F 82000880 8284DD7C 0DF ( 223) NtOpenFile + F 82000884 8284DD6C 0CF ( 207) NtClose + F 82000888 8284DD5C 0EF ( 239) NtQueryVolumeInformationFile + F 8200088C 8284DD4C 0C4 ( 196) MmQueryAddressProtect + F 82000890 8284DD3C 0BD ( 189) MmFreePhysicalMemory + F 82000894 8284DD2C 0BA ( 186) MmAllocatePhysicalMemoryEx + F 82000898 8284DD1C 12E ( 302) RtlInitializeCriticalSection + F 8200089C 8284DD0C 130 ( 304) RtlLeaveCriticalSection + F 820008A0 8284DCFC 125 ( 293) RtlEnterCriticalSection + F 820008A4 8284DCEC 12F ( 303) RtlInitializeCriticalSectionAndSpinCount + F 820008A8 8284E11C 00D ( 13) ExCreateThread + F 820008AC 8284E47C 085 ( 133) KeRaiseIrqlToDpcLevel + F 820008B0 8284E48C 0B3 ( 179) KfLowerIrql + F 820008B4 8284E49C 088 ( 136) KeReleaseSemaphore + F 820008B8 8284E4AC 1F8 ( 504) XAudioGetVoiceCategoryVolume + F 820008BC 8284E4BC 1F7 ( 503) XAudioGetVoiceCategoryVolumeChangeMask + F 820008C0 8284E4CC 0AF ( 175) KeWaitForMultipleObjects + F 820008C4 8284E4DC 092 ( 146) KeResumeThread + F 820008C8 8284E4EC 074 ( 116) KeInitializeSemaphore + F 820008CC 8284E4FC 226 ( 550) XMAReleaseContext + F 820008D0 8284E50C 224 ( 548) XMACreateContext + F 820008D4 8284E51C 083 ( 131) KeQueryPerformanceFrequency + F 820008D8 8284E52C 141 ( 321) RtlTryEnterCriticalSection + F 820008DC 8284E53C 0AE ( 174) KeTryToAcquireSpinLockAtRaisedIrql + F 820008E0 8284E54C 1F3 ( 499) XAudioRegisterRenderDriverClient + F 820008E4 8284E55C 1F4 ( 500) XAudioUnregisterRenderDriverClient + F 820008E8 8284E56C 1F5 ( 501) XAudioSubmitRenderDriverFrame + F 820008EC 8284E57C 195 ( 405) XexGetModuleHandle + F 820008F0 8284E58C 147 ( 327) !! RtlUnwind + F 820008F4 8284E59C 152 ( 338) KeTlsAlloc + F 820008F8 8284E5AC 154 ( 340) KeTlsGetValue + F 820008FC 8284E5BC 155 ( 341) KeTlsSetValue + F 82000900 8284E5CC 153 ( 339) KeTlsFree + F 82000904 8284E5DC 119 ( 281) !! RtlCaptureContext + F 82000908 8284E5EC 05D ( 93) KeEnableFpuExceptions + F 8200090C 8284E5FC 0C6 ( 198) MmQueryStatistics + F 82000910 8284E60C 0D7 ( 215) NtCreateTimer + F 82000914 8284E61C 0FA ( 250) NtSetTimerEx + F 82000918 8284E62C 0CD ( 205) NtCancelTimer + F 8200091C 8284E63C 0E7 ( 231) NtQueryFullAttributesFile + F 82000920 8284E64C 127 ( 295) RtlFreeAnsiString + F 82000924 8284E65C 142 ( 322) RtlUnicodeStringToAnsiString + F 82000928 8284E66C 12D ( 301) RtlInitUnicodeString + F 8200092C 8284E67C 133 ( 307) RtlMultiByteToUnicodeN + F 82000930 8284E68C 001 ( 1) DbgBreakPoint + +w> 000000D4 GameDatabase: Title doesn't contain XLAST data! Multiplayer functionality might be limited. +i> 000000D4 Title name: PROJECT SYLPHEED +i> 000000D4 +-------------------- ACHIEVEMENTS -------------------- ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| ID | Title | Description | Type | Gamerscore | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 1 | Space Combat Award | Received after your first space battle in the Glasner Training Area. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 2 | Schlos Base Defense Award | Received for stopping the missile attack on Schlos Base. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 3 | Aegis of the People Medal | Received for escorting all 7 refugee ships to safety. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 4 | TCAF Luna Medal | Received for bravely helping the fleet escape during the invasion of the Matisse System. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 5 | TCAF Mars Medal | Received for bravery beyond the call of duty during the escape from the Matisse System. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 6 | Soldier's Charm Amulet | Given to you by Raymond as a token of his trust. | Event | 50 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 7 | White Griffons Patch | Received by the commander and pilots of the White Griffon Squadron when it is formed. | Event | 20 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 8 | TCAF Jupiter Medal | Received for bravery during the enemy's attack on the Alberti System. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 9 | Furious Pursuit Badge | Received for continuing attacks on the enemy and shooting down a large number of ships. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 10 | Solo Aerospace Combat Award | Received for descending into Acheron's atmosphere and engaging in combat alone. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 11 | Operation Nebula Blaze Award | Received for completing the extremely hazardous Operation Nebula Blaze. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 12 | Guilty Roses Patch | Received for repelling the Guilty Roses Squadron. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 13 | Super Battleship Slayer Patch | Received for shooting down the second S battleship. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 14 | TCAF Terra Medal | Received for shielding the fleet and seeing that all ships safely fled the Ingres System. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 15 | Hellfires Patch | Received for repelling the enemy Hellfire Squadron. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 16 | Night Ravens Patch | Received for challenging and eradicating the Night Raven Squadron. | Event | 50 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 17 | Solar System Defense Award | Received for great achievements during the campaign to defend the Solar System. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 18 | Special Operations Medal | Received for heroically destroying the Prometheus Driver. | Event | 40 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 19 | 1,000 Units Destroyed Medal | Received for shooting down 1,000 enemy fighters and attackers in combat. | Event | 30 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 20 | 10,000 Units Destroyed Medal | Received for shooting down 10,000 enemy fighters and attackers in combat. | Event | 70 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 21 | Ship Hunter Award | Received for shooting down 100 enemy warships in combat. | Event | 50 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 22 | Gigaton Club Patch | Received for shooting down enemy vessels with a total weight of one gigaton. | Event | 70 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 23 | Weapon Lord Patch | Received after you collect all usable equipment for the Delta Saber. | Event | 80 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +| 24 | TCAF Pilot's Commendation | Commemmorates you as one of the greatest pilots in history. | Event | 100 | ++----+-------------------------------+-------------------------------------------------------------------------------------------+-------+------------+ +i> 000000D4 +-------------------- PROPERTIES -------------------- ++----------+------------------+-------------+-----------+ +| ID | Name | Matchmaking | Data Size | ++----------+------------------+-------------+-----------+ +| 10000006 | Killed Aircrafts | False | 4 | ++----------+------------------+-------------+-----------+ +| 10000008 | Equipments | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000000A | Clear Time | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000000B | Killed Warships | False | 4 | ++----------+------------------+-------------+-----------+ +| 10008001 | Rank | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000800A | | False | 4 | ++----------+------------------+-------------+-----------+ +| 1000800B | | False | 4 | ++----------+------------------+-------------+-----------+ +| 20000005 | Killed Weight | False | 8 | ++----------+------------------+-------------+-----------+ +| 20000007 | Clear Time | False | 8 | ++----------+------------------+-------------+-----------+ +| 20000009 | Earned Points | False | 8 | ++----------+------------------+-------------+-----------+ +| 40008002 | Gamer Name | False | 2 | ++----------+------------------+-------------+-----------+ +i> 000000D4 +-------------------- CONTEXTS -------------------- ++----------+-------------+-------------+---------------+-----------+ +| ID | Name | Matchmaking | Default Value | Max Value | ++----------+-------------+-------------+---------------+-----------+ +| 00000000 | Game Stage | False | 0 | 28 | ++----------+-------------+-------------+---------------+-----------+ +| 00000001 | Game Status | False | 0 | 9 | ++----------+-------------+-------------+---------------+-----------+ +| 00008001 | | False | 0 | 0 | ++----------+-------------+-------------+---------------+-----------+ +| 0000800A | Game Type | True | 0 | 1 | ++----------+-------------+-------------+---------------+-----------+ +| 0000800B | | True | 0 | 0 | ++----------+-------------+-------------+---------------+-----------+ +i> 000000D4 +-------------------- STATS VIEWS -------------------- ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| ID | View Type | Name | Skilled | Arbitrated | Hidden | Team View | Online Only | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000001 | Leaderboard | Time Attack (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000002 | Leaderboard | Score Attack (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000003 | Leaderboard | Extra 1 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000004 | Leaderboard | Extra 1 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000005 | Leaderboard | Extra 2 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000006 | Leaderboard | Extra 2 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000007 | Leaderboard | Extra 3 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000008 | Leaderboard | Extra 3 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 00000009 | Leaderboard | Extra 4 (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 0000000A | Leaderboard | Extra 4 (Permanent) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 0000000C | Leaderboard | Time Attack (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| 0000000D | Leaderboard | Score Attack (Monthly) | False | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +| FFFF0000 | Leaderboard | | True | False | False | False | False | ++----------+-------------+--------------------------+---------+------------+--------+-----------+-------------+ +i> 000000D4 +-------------------- PRESENCE MODES -------------------- ++---------------+----------------+------------------+ +| Context Value | Contexts Count | Properties Count | ++---------------+----------------+------------------+ +| 0 | 2 | 0 | ++---------------+----------------+------------------+ +i> 000000D4 XThread01000020 (5) Stack: 70110000-70130000 +i> 000000D4 KernelState: Launching module... +i> 000000D4 XThreadF8000008 (6) Stack: 70150000-701D0000 +K> 01000020 XThread::Execute thid 5 (handle=01000020, 'Kernel Dispatch (01000020)', native=00000190, ) +K> F8000008 XThread::Execute thid 6 (handle=F8000008, 'Main XThread (F8000008)', native=00000194) +i> 01000010 Loaded 7 shaders from storage +i> 01000010 Loaded 4 pipeline descriptions, 8 shader translations needed +i> 01000010 Translated 7 shaders in 3 ms +i> 01000010 Pipeline cache loaded: 4 created, 0 already exist, 4 total stored +i> 01000010 Pipeline creation took 0 milliseconds +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800000C type=1 initial_state=0 lr=824A9F6C +F> F8000008 NullDevice::ResolvePath() +F> F8000008 NullDevice::ResolvePath() +F> F8000008 NullDevice::ResolvePath() +!> F8000008 undefined extern call to 8284E0DC IoDismountVolumeByFileHandle +F> F8000008 NullDevice::ResolvePath() +i> F8000008 Got xam task args: v1 = 02080002, v2 = 00000000 +i> F8000008 XThreadF8000010 (7) Stack: 701F0000-70270000 +K> F8000010 XThread::Execute thid 7 (handle=F8000010, 'XThread01B8 (F8000010)', native=000001B8) +F> F8000010 NullDevice::ResolvePath() +w> F8000010 Game is attempting to allocate devkit debug memory (base: 00000000, size: 000FF000). Ignoring debug flag and using normal allocation. +!> F8000010 undefined extern call to 8284DEBC StfsCreateDevice +K> F8000010 AUDIT-HLC KeSetEvent guest_ptr=8287094C lr=824A95D0 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000020 type=1 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000024 (8) Stack: 70290000-702B0000 +K> F8000024 XThread::Execute thid 8 (handle=F8000024, 'XThread01BC (F8000024)', native=000001BC) +K> F8000024 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000020 alertable=0 lr=824AC578 guest_lr=824AFFC4 +F> F8000008 HostPathDevice::ResolvePath() +i> F8000008 XThreadF800002C (9) Stack: 702D0000-702E0000 +K> F800002C XThread::Execute thid 9 (handle=F800002C, 'XThread01C0 (F800002C)', native=000001C0) +F> F800002C HostPathDevice::ResolvePath() +F> F800002C HostPathDevice::ResolvePath() +F> F8000008 HostPathDevice::ResolvePath(\d4ea4615\e\46ee8ca) +F> F8000008 HostPathDevice::ResolvePath(\d4ea4615\e) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800003C type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000040 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000048 (A) Stack: 70300000-70340000 +K> F8000048 XThread::Execute thid 10 (handle=F8000048, 'XThread01C4 (F8000048)', native=000001C4) +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800003C alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000050 type=0 initial_state=0 lr=824A9F6C +!> F800002C BaseHeap::Release failed because address is not a region start +!> F800002C PhysicalHeap::Release failed due to parent heap failure +F> F800002C HostPathDevice::ResolvePath() +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +F> F800002C HostPathDevice::ResolvePath() +K> F8000048 AUDIT-HLC NtSetEvent handle=F800004C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800003C result=00000000 lr=824AC578 guest_lr=82452E64 +!> F800002C BaseHeap::Release failed because address is not a region start +!> F800002C PhysicalHeap::Release failed due to parent heap failure +K> F800002C AUDIT-HLC NtWaitForSingleObjectEx handle=F8000028 alertable=0 lr=824AC578 guest_lr=824AFFC4 +!> F8000008 BaseHeap::Release failed because address is not a region start +!> F8000008 PhysicalHeap::Release failed due to parent heap failure +!> F8000008 BaseHeap::Release failed because address is not a region start +!> F8000008 PhysicalHeap::Release failed due to parent heap failure +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\8\3421153) +F> F8000008 DiscImageDevice::ResolvePath(\dat) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\355f2f8) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000038 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800004C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F800004C type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000050 type=0 initial_state=0 lr=824A9F6C +i> F8000048 XThreadF8000058 (B) Stack: 70360000-70370000 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F800004C alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 XThread::Execute thid 11 (handle=F8000058, 'XThread01C8 (F8000058)', native=000001C8) +K> F8000058 AUDIT-HLC NtSetEvent handle=F800004C lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800004C result=00000000 lr=824AC578 guest_lr=8245148C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F800003C lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=82452E64 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000038 type=1 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF800004C (C) Stack: 70390000-703A0000 +K> F800004C XThread::Execute thid 12 (handle=F800004C, 'XThread01CC (F800004C)', native=000001CC) +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +i> F8000008 Hardware scaler: width ratio 1:1, height ratio 1:1, final aspect ratio 16:9 +i> 01000010 Selecting rep movs vastcpy. +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000060 type=1 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000064 type=1 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000068 (D) Stack: 703C0000-70440000 +K> F8000068 XThread::Execute thid 13 (handle=F8000068, 'XThread01D0 (F8000068)', native=000001D0) +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +F> F8000008 HostPathDevice::ResolvePath(\aab216c3\a\2c8c185) +F> F8000008 HostPathDevice::ResolvePath(\aab216c3\a) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000070 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000070 alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000078 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 AUDIT-HLC NtSetEvent handle=F8000078 lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000078 result=00000000 lr=824AC578 guest_lr=8245148C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000074 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000070 result=00000000 lr=824AC578 guest_lr=82452E64 +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\73a5c0a) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000070 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000070 alertable=0 lr=824AC578 guest_lr=82452E64 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000078 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000078 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 AUDIT-HLC NtSetEvent handle=F8000078 lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000078 result=00000000 lr=824AC578 guest_lr=8245148C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000074 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000070 result=00000000 lr=824AC578 guest_lr=82452E64 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +i> F8000008 XThreadF8000070 (E) Stack: 70460000-704E0000 +i> F8000008 XThreadF8000074 (F) Stack: 70500000-70580000 +K> F8000070 XThread::Execute thid 14 (handle=F8000070, 'XThread01D4 (F8000070)', native=000001D4) +K> F8000074 XThread::Execute thid 15 (handle=F8000074, 'XThread01D8 (F8000074)', native=000001D8) +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +i> F8000008 AudioSystem::RegisterClient: driver created for index=0, driver=0x705e6d000040 +i> F8000008 AudioSystem::RegisterClient: client 0 registered successfully +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000088 type=0 initial_state=0 lr=824A9F6C +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9\39a9dcc) +F> F8000008 HostPathDevice::ResolvePath(\69d8e45c\9) +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000088 alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000090 type=0 initial_state=0 lr=824A9F6C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000090 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000088 result=00000000 lr=824AC578 guest_lr=8245FA10 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000088 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +F> F8000008 DiscImageDevice::ResolvePath(\dat) +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000090 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000088 alertable=0 lr=824AC578 guest_lr=82460150 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000088 result=00000000 lr=824AC578 guest_lr=82460150 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000088 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000088 alertable=0 lr=824AC578 guest_lr=82179148 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000090 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000088 result=00000000 lr=824AC578 guest_lr=82179148 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +i> F8000008 XThreadF8000088 (10) Stack: 705A0000-705B0000 +K> F8000088 XThread::Execute thid 16 (handle=F8000088, 'XThread01EC (F8000088)', native=000001EC) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000094 alertable=0 lr=824AC578 guest_lr=82173BD4 +K> F8000068 AUDIT-HLC NtSetEvent handle=F8000094 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000094 result=00000000 lr=824AC578 guest_lr=82173BD4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000094 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF8000098 (11) Stack: 705D0000-70650000 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000098 alertable=0 lr=824AC578 guest_lr=822F1B50 +K> F8000098 XThread::Execute thid 17 (handle=F8000098, 'XThread01F0 (F8000098)', native=000001F0) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F800009C type=1 initial_state=1 lr=824A9F6C +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000A0 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\aab216c3\5\ee70e0a) +F> F8000098 HostPathDevice::ResolvePath(\aab216c3\5) +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A0 alertable=0 lr=824AC578 guest_lr=821CBAE0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000AC type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000AC alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 AUDIT-HLC NtSetEvent handle=F80000AC lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000AC result=00000000 lr=824AC578 guest_lr=8245148C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000A8 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000A0 result=00000000 lr=824AC578 guest_lr=821CBAE0 +i> F8000098 XThreadF80000A0 (12) Stack: 70670000-70680000 +K> F80000A0 XThread::Execute thid 18 (handle=F80000A0, 'XThread01F4 (F80000A0)', native=000001F4) +i> F80000A0 XThreadF80000A8 (13) Stack: 706A0000-706D0000 +i> F80000A0 XThreadF80000AC (14) Stack: 706F0000-70720000 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F80000A8 XThread::Execute thid 19 (handle=F80000A8, 'XThread01F8 (F80000A8)', native=000001F8) +K> F80000AC XThread::Execute thid 20 (handle=F80000AC, 'XThread01FC (F80000AC)', native=000001FC) +K> F80000A8 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A4 alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F80000AC AUDIT-HLC NtWaitForSingleObjectEx handle=F80000A4 alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\c\dba806e) +F> F8000098 HostPathDevice::ResolvePath(\87719002\c) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +F> F8000098 HostPathDevice::ResolvePath(\87719002\c\ec0a96e) +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +F> F8000098 HostPathDevice::ResolvePath(\87719002\c) +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000C8 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\a\60fcb85) +F> F8000098 HostPathDevice::ResolvePath(\87719002\a) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000D4 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\2\85d8849) +F> F8000098 HostPathDevice::ResolvePath(\87719002\2) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\a\715f485) +F> F8000098 HostPathDevice::ResolvePath(\87719002\a) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000EC type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\c\f2a8ccd) +F> F8000098 HostPathDevice::ResolvePath(\87719002\c) +K> F8000098 AUDIT-HLC NtCreateEvent handle=F80000F8 type=0 initial_state=0 lr=824A9F6C +F> F8000098 HostPathDevice::ResolvePath(\87719002\0\1a2db9c) +F> F8000098 HostPathDevice::ResolvePath(\87719002\0) +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E0 alertable=0 lr=824AC578 guest_lr=821C515C +F> F80000A0 DiscImageDevice::ResolvePath(\hidden\Resource3D) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F8000108 type=1 initial_state=0 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000108 alertable=0 lr=824AC578 guest_lr=822DFCC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000110 type=0 initial_state=0 lr=824A9F6C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000B8 lr=824AA304 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000C4 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D0 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000DC lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000E8 lr=824AA304 +K> F8000098 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E0 result=00000000 lr=824AC578 guest_lr=821C515C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000F4 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000098 result=00000000 lr=824AC578 guest_lr=822F1B50 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000100 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F800010C lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000108 result=00000000 lr=824AC578 guest_lr=822DFCC8 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000108 alertable=0 lr=824AC578 guest_lr=822DFE24 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000094 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000108 result=00000000 lr=824AC578 guest_lr=822DFE24 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000098 type=0 initial_state=0 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000108 alertable=0 lr=824AC578 guest_lr=822DFED0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF80000C0 (15) Stack: 705D0000-705E0000 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000C4 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F80000C0 XThread::Execute thid 21 (handle=F80000C0, 'XThread0200 (F80000C0)', native=00000200) +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000C4 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000B8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000B4 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000108 result=00000000 lr=824AC578 guest_lr=822DFED0 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000B4 type=1 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +i> F8000008 XThreadF80000B8 (16) Stack: 70600000-70610000 +K> F80000B8 XThread::Execute thid 22 (handle=F80000B8, 'XThread0204 (F80000B8)', native=00000204) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000CC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000CC alertable=0 lr=824AC578 guest_lr=82172BC8 +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000CC lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000CC result=00000000 lr=824AC578 guest_lr=82172BC8 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F80000B8 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B4 alertable=0 lr=824AC578 guest_lr=824AFFC4 +F> F80000A0 DiscImageDevice::ResolvePath(\hidden\Resource3D) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000D0 type=1 initial_state=0 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFCC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFCC8 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFE24 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000E0 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFE24 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFED0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000DC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000E8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F4 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF80000DC (17) Stack: 70630000-70640000 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F4 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F4 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F4 type=0 initial_state=0 lr=824A9F6C +K> F80000DC XThread::Execute thid 23 (handle=F80000DC, 'XThread0208 (F80000DC)', native=00000208) +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F4 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000F4 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000FC type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF80000F4 (18) Stack: 70740000-707C0000 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF800010C (19) Stack: 707E0000-70860000 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F80000F4 XThread::Execute thid 24 (handle=F80000F4, 'XThread020C (F80000F4)', native=0000020C) +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F800010C XThread::Execute thid 25 (handle=F800010C, 'XThread0210 (F800010C)', native=00000210) +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFED0 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +F> F80000A0 DiscImageDevice::ResolvePath(\hidden\Resource3D) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000D0 type=1 initial_state=0 lr=824A9F6C +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFCC8 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFCC8 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFE24 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFE24 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D0 alertable=0 lr=824AC578 guest_lr=822DFED0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D0 result=00000000 lr=824AC578 guest_lr=822DFED0 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\f\ca5c62e) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000CC type=0 initial_state=0 lr=824A9F6C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\d\14ba3f8) +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\d) +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000CC alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +!> F8000048 BaseHeap::Release failed because address is not a region start +!> F8000048 PhysicalHeap::Release failed due to parent heap failure +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000CC result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\8\14c242d) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000CC type=0 initial_state=0 lr=824A9F6C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\5\6324af0) +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\5) +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000CC alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000CC result=00000000 lr=824AC578 guest_lr=8245FA10 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\d\70a9531) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000CC type=0 initial_state=0 lr=824A9F6C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\a\c9606f9) +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\a) +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000CC alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000CC result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\7\9f2d535) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000CC type=0 initial_state=0 lr=824A9F6C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\4\efaecd1) +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\4) +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000CC alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000CC result=00000000 lr=824AC578 guest_lr=8245FA10 +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\7\0c3bba2) +K> F80000A0 AUDIT-HLC NtCreateEvent handle=F80000CC type=0 initial_state=0 lr=824A9F6C +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\4\59fbfe8) +F> F80000A0 HostPathDevice::ResolvePath(\69d8e45c\4) +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000CC alertable=0 lr=824AC578 guest_lr=8245FA10 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtSetEvent handle=F80000D8 lr=824AA304 +K> F80000A0 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000CC result=00000000 lr=824AC578 guest_lr=8245FA10 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000B0 type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000B0 alertable=0 lr=824AC578 guest_lr=821CC19C +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000B0 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000B0 result=00000000 lr=824AC578 guest_lr=821CC19C +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800009C alertable=0 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800009C result=00000000 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800009C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000BC alertable=0 lr=824AC578 guest_lr=821CC19C +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000BC lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000BC result=00000000 lr=824AC578 guest_lr=821CC19C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F800009C alertable=0 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800009C result=00000000 lr=824AC578 guest_lr=823DEF4C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800009C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +i> F8000008 XThreadF80000CC (1A) Stack: 70880000-70900000 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F80000CC XThread::Execute thid 26 (handle=F80000CC, 'XThread0214 (F80000CC)', native=00000214) +K> F80000CC AUDIT-HLC NtCreateEvent handle=F80000D0 type=1 initial_state=1 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F80000CC AUDIT-HLC NtCreateEvent handle=F80000D8 type=0 initial_state=0 lr=824A9F6C +F> F80000CC HostPathDevice::ResolvePath(\aab216c3\5\c10eae6) +F> F80000CC HostPathDevice::ResolvePath(\aab216c3\5) +K> F80000CC AUDIT-HLC NtWaitForSingleObjectEx handle=F80000D8 alertable=0 lr=824AC578 guest_lr=821CBAE0 +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000114 alertable=0 lr=824AC578 guest_lr=8245148C +K> F8000058 AUDIT-HLC NtSetEvent handle=F8000114 lr=824AA304 +K> F8000048 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000114 result=00000000 lr=824AC578 guest_lr=8245148C +K> F8000048 AUDIT-HLC NtSetEvent handle=F8000110 lr=824AA304 +K> F80000CC AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000D8 result=00000000 lr=824AC578 guest_lr=821CBAE0 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000088 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +F> F8000088 DiscImageDevice::ResolvePath(\dat) +K> F8000088 AUDIT-HLC NtSetEvent handle=F8000114 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000104 alertable=0 lr=824AC578 guest_lr=82460150 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000104 result=00000000 lr=824AC578 guest_lr=82460150 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> F8000048 AUDIT-HLC NtCreateEvent handle=F8000104 type=0 initial_state=0 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000E4 alertable=0 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000E4 result=00000000 lr=824AC578 guest_lr=821C7D3C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F80000BC type=0 initial_state=0 lr=824A9F6C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F80000BC alertable=0 lr=824AC578 guest_lr=82172BC8 +K> F8000068 AUDIT-HLC NtSetEvent handle=F80000BC lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F80000BC result=00000000 lr=824AC578 guest_lr=82172BC8 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000038 alertable=0 lr=824AC578 guest_lr=822F1FC8 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +F> F8000008 DiscImageDevice::ResolvePath(\dat\movie) +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000114 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000118 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800011C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000120 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000124 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000128 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800012C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000130 type=0 initial_state=1 lr=824A9F6C +F> F8000008 DiscImageDevice::ResolvePath(\dat\movie) +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000138 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800013C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000140 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000144 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000148 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F800014C type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000150 type=0 initial_state=1 lr=824A9F6C +K> F8000008 AUDIT-HLC NtCreateEvent handle=F8000154 type=0 initial_state=1 lr=824A9F6C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +i> F8000008 XThreadF8000158 (1B) Stack: 70880000-70890000 +i> F8000008 XThreadF800015C (1C) Stack: 708B0000-708C0000 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +i> F8000008 XThreadF8000160 (1D) Stack: 708E0000-708F0000 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +i> F8000008 XThreadF8000164 (1E) Stack: 70910000-70920000 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000038 lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000068 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000038 result=00000000 lr=824AC578 guest_lr=822F1FC8 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE25404 lr=82507ABC +K> F800015C XThread::Execute thid 28 (handle=F800015C, 'XThread021C (F800015C)', native=0000021C) +K> F8000158 XThread::Execute thid 27 (handle=F8000158, 'XThread0218 (F8000158)', native=00000218) +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000160 XThread::Execute thid 29 (handle=F8000160, 'XThread0220 (F8000160)', native=00000220) +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> F8000068 AUDIT-HLC KeSetEvent guest_ptr=BCE253A4 lr=82508358 +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE25394 lr=82508510 +K> F8000074 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82508524 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> 0100001C AUDIT-HLC KeSetEvent guest_ptr=828A3254 lr=824D2A44 +K> F8000070 AUDIT-HLC KeSetEvent guest_ptr=828A3244 lr=824D292C +K> F8000158 AUDIT-HLC KeSetEvent guest_ptr=BCE253B4 lr=82506C90 +K> 01000014 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=0 cpu=2 +K> 01000014 AUDIT-HLC NtSetEvent handle=F8000060 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F8000060 result=00000000 lr=824AC578 guest_lr=8216EE14 +K> F8000008 AUDIT-HLC NtSetEvent handle=F800000C lr=824AA304 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx_done handle=F800000C result=00000000 lr=824AC578 guest_lr=824AFFC4 +K> F8000008 AUDIT-HLC NtSetEvent handle=F8000064 lr=824AA304 +K> F8000008 AUDIT-HLC NtWaitForSingleObjectEx handle=F8000060 alertable=0 lr=824AC578 guest_lr=8216EE14 +K> F8000088 AUDIT-HLC NtWaitForSingleObjectEx handle=F800000C alertable=0 lr=824AC578 guest_lr=824AFFC4 +K> F800015C AUDIT-HLC KeSetEvent guest_ptr=BCE253C4 lr=82506F9C +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 +K> 01000010 AUDIT-HLC EmulateCPInterruptDPC callback=824BE9A0 data=BE568F00 source=1 cpu=2 diff --git a/audit-runs/iterate-2D-deferred-fixes/DEFERRED_FIXES.md b/audit-runs/iterate-2D-deferred-fixes/DEFERRED_FIXES.md new file mode 100644 index 0000000..6ffc1e9 --- /dev/null +++ b/audit-runs/iterate-2D-deferred-fixes/DEFERRED_FIXES.md @@ -0,0 +1,47 @@ +# iterate-2D Deferred Structural Fixes — Outcome + +Branch `iterate-2D/subsystem-fixes`. After verification + the user's go-ahead: + +## Issue 1 — 32-bit word-form ALU truncation (PPCBUG-020) — ✅ FIXED & LANDED +Commit **341196a**. Confirmed load-bearing via runtime ours-vs-canary capture: +Sylpheed's ms→LARGE_INTEGER converter `sub_824ACA88` (`clrldi; mulli r11,r11,-10000; std`) +produced `0x00000000_FFFD8F00` in ours vs canary's correct `0xFFFFFFFF_FFFD8F00` for a 16 ms +wait — a positive (absolute) timeout → ~26000× over-wait that froze the main frame loop. +Fixed the 17 data-losing word-form ops (full 64-bit result, CA/OV/CR0 preserved byte-identical), +updated 7 bug-asserting tests, re-baselined `sylpheed_n50m` (imports 40454→1790936), `sylpheed_n2m` +unchanged. 660/660 + ignored oracle green; lockstep determinism preserved. Boot unwedged +(parallel NtWaitForMultipleObjectsEx 94→30428; frozen worker/critical-section loops now run). +VdSwap still 1 — rendering progression needs the out-of-scope acd1656 fixes (nt_create_event +polarity + 2.AF), not in this branch. + +## Issue 2 — Memory page-size per-region collapse — DEFERRED (verified NOT load-bearing) +Sylpheed requests `MmAllocatePhysicalMemoryEx` with flags=0, alignment(r8)=0 (default); ours returns +self-consistent 4K-aligned addresses and boots. ours has no 0xA0/0xC0/0xE0 physical-region model at +all, so a faithful fix is a region-model rewrite that shifts every physical guest VA (golden-breaking, +invalidates the audit-059 VA map) with no demonstrated boot benefit. A partial page-size-only change +would shift VAs for zero correctness gain — do NOT do it piecemeal. Pursue only if a render-path +struct is proven to depend on physical region/alignment. + +## Issue 3 — Timing — LEFT (not load-bearing / determinism-coupled) +- 3d DPC/APC: INERT — the only timer (NtSetTimerEx) passes a NULL APC routine; no + NtQueueApcThread/KeInsertQueueDpc imported. +- 3b timeout sign: was a SYMPTOM of Issue 1 (the "positive absolute" timeouts were mulli-corruption + artifacts) — resolved by the Issue 1 fix. +- 3a/3c timebase/skew: timebase = instruction-count IS the deterministic lockstep clock; must not + become wallclock. 2.AF deadline-drain already present. Not load-bearing for Sylpheed. + +## Issue 4 — VFS synthesized-success-on-miss — LEFT (risky / coupled to Issue 1 trajectory) +The synthesis fallback handles a MIX (writable-partition probes partition0/Cache0 + a genuine disc +miss dat/files.tbl, verified absent from the ISO). Canary doesn't fire XamShowDirtyDiscErrorUI during +boot (the one "DirtyDisc" log hit is the import-table declaration). Not cleanly separable without +heuristic disc-vs-partition routing. Re-verify on the corrected post-Issue-1 (and post-acd1656) +trajectory before changing. + +## Issue 5 — Mutant object — SKIPPED (verified unused) +Sylpheed's XEX import table contains NO mutant symbols (NtCreateMutant/NtReleaseMutant/KeReleaseMutant/ +KeInitializeMutant/NtQueryMutant) — the game cannot call them; unimplemented=0 across boot. A correct +implementation needs mutant hand-off semantics + an owner-type redesign (the existing +`Mutex { owner: Option }` tracks a HW slot, not a thread) in the determinism-critical wait path, +for code that never executes. Per the mandate's skip-if-unused criterion, left unimplemented. Can be +added on request as a pure canary-parity / future-title feature (determinism-safe since no Sylpheed +mutant ever exists at runtime). diff --git a/crates/xenia-app/src/main.rs b/crates/xenia-app/src/main.rs index 685e5a9..f966583 100644 --- a/crates/xenia-app/src/main.rs +++ b/crates/xenia-app/src/main.rs @@ -2619,6 +2619,10 @@ fn worker_prologue( match result { StepResult::Continue => {} + StepResult::Yield => { + // db16cyc spin-wait hint (per-instruction path): yield the slot. + kernel.scheduler.yield_current(); + } StepResult::SystemCall => { tracing::warn!("SYSCALL at {:#010x} (hw={})", pc, hw_id); } @@ -2698,6 +2702,11 @@ fn worker_epilogue( match result { StepResult::Continue => {} + StepResult::Yield => { + // db16cyc spin-wait hint: hand the slot to a Ready peer so the + // spinner doesn't starve the co-located thread it is waiting on. + kernel.scheduler.yield_current(); + } StepResult::SystemCall => { let last_pc = block.instrs.last().map(|i| i.addr).unwrap_or(pc_before); tracing::warn!("SYSCALL at {:#010x} (hw={})", last_pc, hw_id); @@ -3638,6 +3647,9 @@ fn dispatch_graphics_interrupts( isr_instrs += 1; match r { StepResult::Continue => {} + // db16cyc inside the synchronous ISR has no slot to yield — + // the ISR runs to completion on the borrowed context. + StepResult::Yield => {} StepResult::SystemCall => { tracing::warn!("graphics ISR hit `sc` instruction; aborting"); break; diff --git a/crates/xenia-app/tests/golden/sylpheed_n50m.json b/crates/xenia-app/tests/golden/sylpheed_n50m.json index cce349d..066a518 100644 --- a/crates/xenia-app/tests/golden/sylpheed_n50m.json +++ b/crates/xenia-app/tests/golden/sylpheed_n50m.json @@ -1,9 +1,9 @@ { - "instructions": 50000003, - "imports": 90296, + "instructions": 50000000, + "imports": 339766, "unimpl": 0, "draws": 0, - "swaps": 1, + "swaps": 2, "unique_render_targets": 0, "shader_blobs_live": 0, "texture_cache_entries": 0 diff --git a/crates/xenia-cpu/src/interpreter.rs b/crates/xenia-cpu/src/interpreter.rs index 29288a3..582c673 100644 --- a/crates/xenia-cpu/src/interpreter.rs +++ b/crates/xenia-cpu/src/interpreter.rs @@ -28,6 +28,15 @@ pub enum StepResult { Trap, /// Execution halted (by debugger or error). Halted, + /// Executed the `db16cyc` spin-wait hint (`or r31,r31,r31`, encoding + /// `0x7FFFFB78`). The PC has already advanced past the hint; this is a + /// cooperative-yield signal so the scheduler hands the slot to a Ready + /// peer. On real hardware all six HW threads run concurrently and the + /// spin resolves naturally; under our round-robin lockstep a spinning + /// barrier/spinlock participant would otherwise monopolize its slot and + /// starve the co-located thread it is waiting on. Matches canary's + /// `InstrEmit_orx` db16cyc → `DelayExecution()` handling. + Yield, } /// Execute a single PPC instruction. @@ -95,6 +104,9 @@ pub fn step_block( ctx.cycle_count += 1; ctx.timebase += 1; if !matches!(result, StepResult::Continue) { + // `Yield` (db16cyc spin hint) terminates the block here so the + // scheduler regains control and can rotate the slot; the PC has + // already advanced past the hint inside `execute`. return result; } // PC discontinuity within a block. By construction only the @@ -548,6 +560,18 @@ fn execute(ctx: &mut PpcContext, mem: &dyn MemoryAccess, instr: &DecodedInstr) - ctx.gpr[instr.ra()] = ctx.gpr[instr.rs()] | ctx.gpr[instr.rb()]; if instr.rc_bit() { ctx.update_cr_signed(0, ctx.gpr[instr.ra()] as u32 as i32 as i64); } ctx.pc += 4; + // `or r31,r31,r31` with encoding 0x7FFFFB78 is the Xenon `db16cyc` + // spin-wait hint (a no-op write of r31 onto itself). Canary's + // `InstrEmit_orx` special-cases exactly this code → `DelayExecution()`. + // Under our round-robin lockstep, a guest spinlock/barrier loop that + // executes db16cyc would otherwise consume its whole block every round + // and starve the co-located thread it is waiting on (the lock holder / + // barrier peer). Surface it as a cooperative yield so the scheduler can + // hand the slot to a Ready peer. The semantic result of the op is + // already applied (r31 |= r31 is a no-op), so yielding is value-neutral. + if instr.raw == 0x7FFF_FB78 { + return StepResult::Yield; + } } PpcOpcode::orcx => { // PPCBUG-028: same shape as andcx — operate in u32. @@ -5042,6 +5066,40 @@ mod tests { assert_eq!(ctx.pc, 4); } + #[test] + fn test_db16cyc_yields() { + // `or r31,r31,r31` encoding 0x7FFFFB78 is the Xenon db16cyc spin hint. + // It must (a) be value-neutral (r31 unchanged), (b) advance PC, and + // (c) report StepResult::Yield so the scheduler can hand off the slot. + let mut ctx = PpcContext::new(); + let mut mem = TestMem::new(); + write_instr(&mut mem, 0, 0x7FFF_FB78); + ctx.pc = 0; + ctx.gpr[31] = 0x1234_5678_9ABC_DEF0; + let r = step(&mut ctx, &mut mem); + assert_eq!(ctx.gpr[31], 0x1234_5678_9ABC_DEF0, "db16cyc is value-neutral"); + assert_eq!(ctx.pc, 4, "PC advances past the hint"); + assert_eq!(r, StepResult::Yield, "db16cyc surfaces as a cooperative yield"); + } + + #[test] + fn test_plain_or_self_is_not_yield() { + // A regular `or rN,rN,rN` that is NOT the db16cyc encoding (e.g. r3) + // is an ordinary no-op move and must keep executing (Continue), so we + // only yield on the exact spin-hint code canary special-cases. + let mut ctx = PpcContext::new(); + let mut mem = TestMem::new(); + // or r3, r3, r3 (RT=RA=RB=3, Rc=0): 31<<26 | 3<<21 | 3<<16 | 3<<11 | 444<<1 + let raw = (31u32 << 26) | (3 << 21) | (3 << 16) | (3 << 11) | (444 << 1); + write_instr(&mut mem, 0, raw); + ctx.pc = 0; + ctx.gpr[3] = 0xCAFE; + let r = step(&mut ctx, &mut mem); + assert_eq!(ctx.gpr[3], 0xCAFE); + assert_eq!(ctx.pc, 4); + assert_eq!(r, StepResult::Continue, "non-db16cyc or-self stays Continue"); + } + #[test] fn test_fadd() { let mut ctx = PpcContext::new(); diff --git a/crates/xenia-cpu/src/scheduler.rs b/crates/xenia-cpu/src/scheduler.rs index 54409b5..8ea53a6 100644 --- a/crates/xenia-cpu/src/scheduler.rs +++ b/crates/xenia-cpu/src/scheduler.rs @@ -902,6 +902,41 @@ impl Scheduler { false } + /// Cooperative yield: the currently-running thread executed a `db16cyc` + /// spin-wait hint (see `StepResult::Yield`). It is busy-spinning on a + /// guest spinlock/barrier whose release depends on a *co-located* peer + /// that cannot make progress while this thread keeps winning the slot. + /// + /// Promote every Ready peer on this slot past `STARVE_LIMIT` so the next + /// `begin_slot_visit` picks one of them (their `effective_priority` → + /// `i32::MAX`), and reset the yielder's own counter. Each promoted peer + /// runs once and resets to 0 in `begin_slot_visit`; once all peers have + /// had their turn the spinner is picked again, spins, and re-yields — + /// producing a fair round-robin between the spinner and the threads it is + /// waiting on. This mirrors real hardware, where all six HW threads run + /// concurrently and the spin resolves as soon as the peer releases. + /// + /// Pure function of the slot's current state (no RNG, no wall-clock), so + /// it preserves lockstep determinism. No-op if there is no Ready peer + /// (the spinner is alone on its slot — nothing to hand off to). + /// + /// Returns `true` if at least one peer was promoted. + pub fn yield_current(&mut self) -> bool { + let Some(r) = self.current else { return false; }; + let slot = &mut self.slots[r.hw_id as usize]; + let me = r.idx as usize; + let mut promoted = false; + for (i, t) in slot.runqueue.iter_mut().enumerate() { + if i == me { + t.steps_starved = 0; + } else if matches!(t.state, HwState::Ready | HwState::ServicingIrq(_)) { + t.steps_starved = STARVE_LIMIT; + promoted = true; + } + } + promoted + } + // ----- Park / wake / exit ----- pub fn park_current(&mut self, reason: BlockReason) { @@ -2062,6 +2097,71 @@ mod tests { ); } + #[test] + fn test_db16cyc_yield_hands_slot_to_peer() { + // Reproduces the Sylpheed title-screen gate: a guest spinlock/barrier + // participant (tid=1) executes the `db16cyc` spin hint each round and + // would otherwise win `pick_runnable` forever (equal priority, lower + // index), starving the co-located peer (tid=2) it is waiting on. + // `yield_current` must promote the Ready peer so the very next + // `begin_slot_visit` picks it — without waiting STARVE_LIMIT rounds. + let mut s = mk_empty_scheduler(); + for tid in [1u32, 2] { + let mut p = SpawnParams::default(); + p.guest_tid = tid; + p.thread_handle = 0x1000 + tid * 4; + p.affinity_mask = 0b0001; + p.pcr_base = 0x4000_0000 + tid * 0x1000; + p.priority = 0; // equal priority — index would otherwise decide + s.spawn(p, &mut NullPcr).unwrap(); + } + + // Round 1: the spinner (lower index) wins. + s.begin_slot_visit(0); + let spinner = s.thread(s.current.unwrap()).tid; + assert_eq!(spinner, 1, "lower-index equal-priority thread wins first pick"); + // It spins (db16cyc) → cooperative yield. + assert!(s.yield_current(), "yield promotes the Ready peer"); + s.end_slot_visit(); + + // Round 2: the promoted peer must now be picked, not the spinner. + s.begin_slot_visit(0); + let after_yield = s.thread(s.current.unwrap()).tid; + assert_eq!( + after_yield, 2, + "after db16cyc yield the co-located peer runs (no STARVE_LIMIT wait)" + ); + s.end_slot_visit(); + + // Round 3: peer's boost was consumed (reset to 0 when picked), so the + // spinner reclaims the slot — fair alternation, no priority inversion. + s.begin_slot_visit(0); + assert_eq!( + s.thread(s.current.unwrap()).tid, + 1, + "spinner reclaims the slot after the peer has had its turn" + ); + } + + #[test] + fn test_yield_current_noop_when_alone() { + // A spinner with no Ready peer on its slot has nothing to hand off to; + // yield_current must be a no-op (returns false) and not panic. + let mut s = mk_empty_scheduler(); + let mut p = SpawnParams::default(); + p.guest_tid = 1; + p.thread_handle = 0x1004; + p.affinity_mask = 0b0001; + p.pcr_base = 0x4000_0000; + s.spawn(p, &mut NullPcr).unwrap(); + s.begin_slot_visit(0); + assert!(!s.yield_current(), "no peer to promote → no-op"); + // Still the same thread next round. + s.end_slot_visit(); + s.begin_slot_visit(0); + assert_eq!(s.thread(s.current.unwrap()).tid, 1); + } + #[test] fn test_cooperative_yield_does_not_need_quantum() { let mut s = mk_empty_scheduler();